fix: use go version from scanned project

[mfrancisc]

wrt https://redhat-internal.slack.com/archives/CHK0J6HT6/p1773222007541979

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Corrected critical command error that prevented tool execution.

• Refactor

  • Go toolchain is now dynamically resolved from your project configuration (toolchain directive, Go version, or auto) instead of using a static default, improving compatibility across different environments.

[coderabbitai]

Walkthrough

Modified entrypoint.sh to dynamically resolve GOTOOLCHAIN from the scanned go.mod file instead of using a static value. The script now reads both toolchain and go version directives, preferring toolchain if present, otherwise falling back to go version or defaulting to auto.

Changes

Cohort / File(s)	Summary
Entrypoint Script govulncheck-action/entrypoint.sh	Replaced static GOTOOLCHAIN=auto export with dynamic resolution logic that reads toolchain and go directives from go.mod. Introduces new variables GOMOD_TOOLCHAIN and GOMOD_GO. Updates comments to reflect the scanning purpose. Note: Final govulncheck invocation contains potential typo (govulncheckx instead of govulncheck).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: use go version from scanned project' accurately summarizes the main change: dynamically resolving the Go version from the scanned project's go.mod instead of using a static default.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

govulncheck-action/entrypoint.sh (1)

23-23: ⚠️ Potential issue | 🔴 Critical

Typo: govulncheckx should be govulncheck.

The command name has an extra x character, which will cause the script to fail with "command not found" on every invocation.

🐛 Proposed fix

-govulncheckx "$@"
+govulncheck "$@"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@govulncheck-action/entrypoint.sh` at line 23, The script calls a non-existent
command name "govulncheckx" in entrypoint.sh; replace the invocation
govulncheckx "$@" with the correct command govulncheck "$@" so the script
executes the intended tool, and verify the entrypoint still forwards all args
(the "$@" usage should remain unchanged).

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@govulncheck-action/entrypoint.sh`:
- Line 23: The script calls a non-existent command name "govulncheckx" in
entrypoint.sh; replace the invocation govulncheckx "$@" with the correct command
govulncheck "$@" so the script executes the intended tool, and verify the
entrypoint still forwards all args (the "$@" usage should remain unchanged).

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 96db2f42-e567-44ef-8458-077a5f426847

📥 Commits

Reviewing files that changed from the base of the PR and between b69e095 and 40c3576.

📒 Files selected for processing (1)

• govulncheck-action/entrypoint.sh

[rajivnathan]

👍