From c857f45ee49b0067499b08eac42db89a109a970a Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Thu, 5 Nov 2026 13:53:53 +0000
Subject: [PATCH] Add govulncheck (closes #3)

Install govulncheck with go install after the cleanup step, into
/usr/local/bin so it survives the /root/go removal, and check it in the
smoke test.

Model: deepseek-v4-pro
---
 README.md | 1 +
 bin/test  | 1 +
 build.sh  | 8 +++++++-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 6e54728..7819a43 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,7 @@ Image: `git.eeqj.de/sneak/baseimage`, built for `linux/amd64` and
 | Go (latest)     | go.dev tarball                 | `/usr/local/go`                |
 | golangci-lint   | GitHub release                 | `/usr/local/bin/golangci-lint` |
 | shellcheck      | apt                            | `/usr/bin/shellcheck`          |
+| govulncheck     | `go install` (latest)          | `/usr/local/bin/govulncheck`   |
 | Hugo (extended) | GitHub release `.deb`          | `/usr/local/bin/hugo`          |
 | Node (distro)   | apt `nodejs`, `npm`            | `/usr/bin/node`                |
 | nvm             | git tag                        | `/usr/local/nvm`               |
diff --git a/bin/test b/bin/test
index b9bb40c..5dde42f 100755
--- a/bin/test
+++ b/bin/test
@@ -22,6 +22,7 @@ docker run --rm "$img" bash -ec '
     COREPACK_ENABLE_NETWORK=0 pnpm --version
     prettier --version
     shellcheck --version
+    govulncheck -version
 '
 
 echo "== $img: runit service lifecycle"
diff --git a/build.sh b/build.sh
index ba86760..5985967 100755
--- a/build.sh
+++ b/build.sh
@@ -94,8 +94,14 @@ rm -rf /usr/share/doc /usr/share/man /usr/share/info /usr/share/lintian
 find /usr/share/locale -mindepth 1 -maxdepth 1 ! -name 'en*' ! -name 'locale.alias' -exec rm -rf {} +
 rm -rf /root/.cache /root/.npm /root/.config /root/go /tmp/* /var/tmp/*
 
+# --- govulncheck (Go tool) ---------------------------------------------------
+# `go install` drops binaries in /root/go/bin, which the cleanup above
+# removes; install into /usr/local/bin so it stays on PATH.
+GOBIN=/usr/local/bin go install golang.org/x/vuln/cmd/govulncheck@latest
+
 # --- sanity ------------------------------------------------------------------
 go version
+govulncheck -version
 golangci-lint version
 shellcheck --version
 hugo version
@@ -112,5 +118,5 @@ test -x /usr/local/sbin/runsvinit
 test -d /etc/service
 
 # The checks above leave caches behind (node compile cache etc).
-rm -rf /tmp/* /var/tmp/* /root/.cache /root/.npm /root/.config
+rm -rf /tmp/* /var/tmp/* /root/.cache /root/.npm /root/.config /root/go
 rm -f "$0"