From 3ca57ea6cc56acb7167a5588d0dd4db363868b5c Mon Sep 17 00:00:00 2001
From: Foreman Bot <chris@mahercode.io>
Date: Sat, 18 Jul 2026 05:30:39 -0700
Subject: [PATCH] chore: add `make vulncheck` target for local govulncheck
 scanning

Add a `make vulncheck` target to the Makefile that installs a pinned
govulncheck binary (v1.1.4, commit d1f3801) and runs `govulncheck ./...`
against the module. This mirrors the existing CI workflow in
.github/workflows/security.yml which already runs govulncheck on push,
PR, and a weekly schedule.

The Makefile target follows the same pattern as other tool targets
(golangci-lint, controller-gen): a prerequisite target that downloads
the binary via `go-install-tool`, and a user-facing target that invokes
the tool.

Running `make vulncheck` reports no vulnerabilities found.

Fixes #1100

Signed-off-by: Foreman Bot <chris@mahercode.io>
---
 Makefile | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/Makefile b/Makefile
index 34fcbe09..9dd0d61b 100644
--- a/Makefile
+++ b/Makefile
@@ -470,6 +470,7 @@ KUSTOMIZE ?= $(LOCALBIN)/kustomize
 CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
 ENVTEST ?= $(LOCALBIN)/setup-envtest
 GOLANGCI_LINT = $(LOCALBIN)/golangci-lint
+GOVULNCHECK = $(LOCALBIN)/govulncheck
 
 ## Tool Versions
 KUSTOMIZE_VERSION ?= v5.7.1
@@ -479,6 +480,7 @@ ENVTEST_VERSION ?= $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller
 #ENVTEST_K8S_VERSION is the version of Kubernetes to use for setting up ENVTEST binaries (i.e. 1.31)
 ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')
 GOLANGCI_LINT_VERSION ?= v2.12.2
+GOVULNCHECK_VERSION ?= d1f380186385b4f64e00313f31743df8e4b89a77
 
 .PHONY: kustomize
 kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
@@ -508,6 +510,15 @@ golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary.
 $(GOLANGCI_LINT): $(LOCALBIN)
 	$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/v2/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))
 
+.PHONY: govulncheck
+govulncheck: $(GOVULNCHECK) ## Download govulncheck locally if necessary.
+$(GOVULNCHECK): $(LOCALBIN)
+	$(call go-install-tool,$(GOVULNCHECK),golang.org/x/vuln/cmd/govulncheck,$(GOVULNCHECK_VERSION))
+
+.PHONY: vulncheck
+vulncheck: govulncheck ## Run govulncheck against the module.
+	$(GOVULNCHECK) ./...
+
 # go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
 # $1 - target path with name of binary
 # $2 - package url which can be installed