[BUG] command govulncheck not found in CI

[vitorfloriano]

What happened?

When running the verify-govulncheck script in CI, the govulncheck command is not found:

Installing govulncheck@v1.1.4...
go: downloading golang.org/x/vuln v1.1.4
go: downloading golang.org/x/telemetry v0.0.0-20240522233618-39ace7a40ae7
go: downloading golang.org/x/mod v0.22.0
go: downloading golang.org/x/tools v0.29.0
go: downloading golang.org/x/sync v0.10.0
Creating worktree for base branch 'main'...
Running govulncheck on HEAD (PR branch)...
push_pin
hack/verify-govulncheck.sh: line 50: govulncheck: command not found
Running govulncheck on base branch 'main'...
hack/verify-govulncheck.sh: line 54: govulncheck: command not found

Steps to Reproduce

This has been happening in CI for quite some time:

• https://prow.k8s.io/view/gs/kubernetes-ci-logs/pr-logs/pull/kubernetes-sigs_node-readiness-controller/381/pull-node-readiness-controller-verify-all/2090071115220127744#1:build-log.txt%3A77-79
• https://prow.k8s.io/view/gs/kubernetes-ci-logs/pr-logs/pull/kubernetes-sigs_node-readiness-controller/381/pull-node-readiness-controller-verify-all/2089867701190135808#1:build-log.txt%3A77-79
• https://prow.k8s.io/view/gs/kubernetes-ci-logs/pr-logs/pull/kubernetes-sigs_node-readiness-controller/286/pull-node-readiness-controller-verify-all/2089418494150971392#1:build-log.txt%3A77-79

Expected Behavior

It should report all the vulnerabilites found in Go v1.26 (about 22).

Controller Version / Image Tag

N/A

Kubernetes Version

N/A

Controller Logs

./hack/verify-all.sh
make[1]: Entering directory '/home/prow/go/src/github.com/kubernetes-sigs/node-readiness-controller'
GOBIN=/home/prow/go/src/github.com/kubernetes-sigs/node-readiness-controller/hack/tools/bin ./scripts/go_install.sh sigs.k8s.io/controller-tools/cmd/controller-gen controller-gen v0.19.0
go: downloading go1.26.0 (linux/amd64)
go: downloading sigs.k8s.io/controller-tools v0.19.0
go: downloading github.com/spf13/cobra v1.9.1
go: downloading golang.org/x/tools v0.36.0
go: downloading github.com/spf13/pflag v1.0.7
go: downloading k8s.io/apimachinery v0.34.0
go: downloading k8s.io/code-generator v0.34.0
go: downloading k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f
go: downloading github.com/gobuffalo/flect v1.0.3
go: downloading k8s.io/apiextensions-apiserver v0.34.0
go: downloading k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading github.com/fatih/color v1.18.0
go: downloading k8s.io/api v0.34.0
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading sigs.k8s.io/yaml v1.6.0
go: downloading golang.org/x/sync v0.16.0
go: downloading github.com/google/gnostic-models v0.7.0
go: downloading go.yaml.in/yaml/v2 v2.4.2
go: downloading k8s.io/klog/v2 v2.130.1
go: downloading k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b
go: downloading github.com/gogo/protobuf v1.3.2
go: downloading sigs.k8s.io/randfill v1.0.0
go: downloading sigs.k8s.io/structured-merge-diff/v6 v6.3.0
go: downloading github.com/mattn/go-colorable v0.1.13
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading golang.org/x/mod v0.27.0
go: downloading go.yaml.in/yaml/v3 v3.0.4
go: downloading google.golang.org/protobuf v1.36.7
go: downloading github.com/go-logr/logr v1.4.3
go: downloading github.com/go-openapi/jsonreference v0.20.2
go: downloading github.com/go-openapi/swag v0.23.0
go: downloading sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8
go: downloading gopkg.in/inf.v0 v0.9.1
go: downloading github.com/json-iterator/go v1.1.12
go: downloading golang.org/x/sys v0.35.0
go: downloading github.com/go-openapi/jsonpointer v0.21.0
go: downloading github.com/fxamacker/cbor/v2 v2.9.0
go: downloading github.com/mailru/easyjson v0.7.7
go: downloading golang.org/x/net v0.43.0
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee
go: downloading github.com/x448/float16 v0.8.4
go: downloading github.com/josharian/intern v1.0.0
go: downloading golang.org/x/text v0.28.0
/home/prow/go/src/github.com/kubernetes-sigs/node-readiness-controller/hack/tools/bin/controller-gen-v0.19.0 rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
make[1]: Leaving directory '/home/prow/go/src/github.com/kubernetes-sigs/node-readiness-controller'
downloading lychee-x86_64-unknown-linux-gnu.tar.gz from https://github.com/lycheeverse/lychee/releases/download/lychee-v0.23.0/lychee-x86_64-unknown-linux-gnu.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0

100 7250k  100 7250k    0     0  59.8M      0 --:--:-- --:--:-- --:--:-- 59.8M
Checking links in Markdown files...
    [WARN] lychee detected 18 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Run lychee in verbose mode (-v/--verbose) to see details about the redirections.
📝 Summary
---------------------
🔍 Total..........203
✅ Successful.....180
⏳ Timeouts.........0
🔀 Redirected......18
👻 Excluded.........5
❓ Unknown..........0
🚫 Errors...........0
⛔ Unsupported......0

Installing govulncheck@v1.1.4...
go: downloading golang.org/x/vuln v1.1.4
go: downloading golang.org/x/telemetry v0.0.0-20240522233618-39ace7a40ae7
go: downloading golang.org/x/mod v0.22.0
go: downloading golang.org/x/tools v0.29.0
go: downloading golang.org/x/sync v0.10.0
Creating worktree for base branch 'main'...
Running govulncheck on HEAD (PR branch)...
hack/verify-govulncheck.sh: line 50: govulncheck: command not found
Running govulncheck on base branch 'main'...
hack/verify-govulncheck.sh: line 54: govulncheck: command not found

=== HEAD (PR branch) ===


=== BASE (main) ===

Files /tmp/tmp.AyKIPtS11V/pr-base.txt and /tmp/tmp.AyKIPtS11V/head.txt are identical

Additional Environment Details

No response

[vitorfloriano]

/assign @vitorfloriano

[ajaysundark]

/triage accepted