From c10beba5393ac57f8927e4732e6de00e25004bd9 Mon Sep 17 00:00:00 2001
From: thc1006 <84045975+thc1006@users.noreply.github.com>
Date: Thu, 9 Jul 2026 02:29:49 +0800
Subject: [PATCH] fix(ci): correct the govulncheck-action pin comment

The govulncheck step pins golang/govulncheck-action to an untagged
master commit (032d455) because no release since v1.0.4 (Oct 2024)
carries the Node 24 fix. The pin comment named the wrong upstream
branch -- the action's default branch is "master", not "main" -- and
used a "pin@<sha>" form that mimics the repo's "pin@<tag>" convention
for an entry that has no tag.

Name the correct branch and mark the line as manually maintained
until upstream tags a release. Re-pin to the tag once one exists.

Refs: #32301, golang/go#78345
Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
---
 .github/workflows/govulncheck.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 5e5111432..602c9a460 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -30,6 +30,6 @@ jobs:
           go-version: '${{ env.GOLANG_VERSION }}'
           check-latest: true
       - name: govulncheck
-        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # pin@032d455 (from main 2026-07-06)
+        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # master 032d455 (2026-07-06); no tagged release yet, manually maintained - see #32301
         with:
           go-package: ./...