infra: refactor govulncheck target and hack script.

The govulncheck script now uses the same
mechanism for the other tools in hack/tools/bin.

Author: vitorfloriano

Makefile

@@ -178,9 +178,9 @@ lint-api-fix: $(GOLANGCI_LINT_KAL)
 lint-config: $(GOLANGCI_LINT) ## Verify golangci-lint linter configuration
 	$(GOLANGCI_LINT) config verify
 
-.PHONY: govulncheck
-govulncheck: $(GOVULNCHECK) ## Run govulncheck to detect known vulnerabilities.
-	$(GOVULNCHECK) -scan package ./...
+.PHONY: verify-govulncheck
+verify-govulncheck: $(GOVULNCHECK) ## Run govulncheck verification against base branch.
+	GOVULNCHECK="$(GOVULNCHECK)" ./hack/verify-govulncheck.sh
 
 .PHONY: verify
 verify: ## Run all verification scripts.
@@ -449,6 +449,9 @@ $(GOLANGCI_LINT_BIN): $(GOLANGCI_LINT) ## Build a local copy of golangci-lint.
 .PHONY: $(KIND_BIN)
 $(KIND_BIN): $(KIND) ## Build a local copy of kind.
 
+.PHONY: $(GOVULNCHECK_BIN)
+$(GOVULNCHECK_BIN): $(GOVULNCHECK) ## Build a local copy of govulncheck.
+
 $(KUSTOMIZE): # Build kustomize from tools folder.
 	CGO_ENABLED=0 GOBIN=$(TOOLS_BIN_DIR) $(GO_INSTALL) $(KUSTOMIZE_PKG) $(KUSTOMIZE_BIN) $(KUSTOMIZE_VER)
 

hack/verify-govulncheck.sh

@@ -18,12 +18,14 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-GOVULNCHECK_VERSION="${GOVULNCHECK_VERSION:-v1.1.4}"
+KUBE_ROOT="$(dirname "${BASH_SOURCE[0]}")/.."
+cd "${KUBE_ROOT}"
 
-# Install govulncheck if not already present.
-if ! command -v govulncheck &>/dev/null; then
-  echo "Installing govulncheck@${GOVULNCHECK_VERSION}..."
-  go install "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}"
+GOVULNCHECK="${GOVULNCHECK:-${KUBE_ROOT}/hack/tools/bin/govulncheck}"
+
+# Ensure govulncheck binary is built
+if [[ ! -x "${GOVULNCHECK}" ]]; then
+  make -C "${KUBE_ROOT}" govulncheck
 fi
 
 # NRC_VERIFY_GIT_BRANCH is populated in verify CI jobs (e.g. GITHUB_BASE_REF
@@ -47,11 +49,11 @@ git worktree add -f -q "${WORKTREE}" "${BRANCH}"
 trap 'git worktree remove -f "${WORKTREE}"; rm -rf "${TMPDIR}"' EXIT
 
 echo "Running govulncheck on HEAD (PR branch)..."
-govulncheck -scan package ./... > "${TMPDIR}/head.txt" || true
+"${GOVULNCHECK}" -scan package ./... > "${TMPDIR}/head.txt" || true
 
 echo "Running govulncheck on base branch '${BRANCH}'..."
 pushd "${WORKTREE}" >/dev/null
-  govulncheck -scan package ./... > "${TMPDIR}/pr-base.txt" || true
+  "${GOVULNCHECK}" -scan package ./... > "${TMPDIR}/pr-base.txt" || true
 popd >/dev/null
 
 echo -e "\n=== HEAD (PR branch) ===\n$(cat "${TMPDIR}/head.txt")"