32271322248
70%

Ran 19 Aug 2026 03:46PM UTC

Jobs 1

Files 879

Run time 3min

Badge

Embed ▾

Committed 19 Aug 2026 03:38PM UTC coverage: 70.468% (+0.004%) from 70.464%

Build # 32271322248

Build Type

push

github

Committed by

web-flow

Commit Message

Name the concrete removal trigger for the openpgp exclusion (#6286)

* Name the concrete removal trigger for the openpgp exclusion

"Remove when sigstore drops the dependency" is not something anyone can
check, so the entry would outlive its cause. Rekor already made the
change — sigstore/rekor#2883, merged after v1.5.3 — so the trigger is a
release containing it.

Also record the import chain and that every govulncheck trace is
package-init reachability rather than a call, which is the part that
makes the exclusion defensible.

* Fail the vulnerability gate when the scan itself fails

The trailing `|| true` covered the whole pipeline, so a jq parse error, an
empty output file, or a missing one all produced an empty finding list —
indistinguishable from a clean scan, and the gate reported success.

Verified against malformed, empty, and missing output: all three passed
before, all three now fail. A genuinely clean scan and a real unexcluded
finding both keep their previous verdicts.

Found in review of stacklok/toolhive-core#230, whose equivalent step was
modelled on this one.

Coverage Stats

86216 of 122347 relevant lines covered (70.47%)

101.14 hits per line

Coverage Regressions

Lines	Coverage	∆	File
3	49.27	-0.62%	pkg/transport/stdio.go
2	61.31	-0.17%	pkg/workloads/manager.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	32271322248.1	19 Aug 2026 03:46PM UTC	879	70.47	GitHub Action Run

stacklok / toolhive / 32271322248
70%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 32271322248

stacklok / toolhive / 32271322248 70%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 32271322248

stacklok / toolhive / 32271322248
70%

README BADGES
x