From edec4ca162569bab6c9dc33d558dd8cd2bbe9752 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Thu, 5 Nov 2026 15:01:09 +0000
Subject: [PATCH] fixup! Add govulncheck (closes #3)

Model: deepseek-v4-pro
---
 build.sh | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/build.sh b/build.sh
index 525b31e..deb2fe7 100755
--- a/build.sh
+++ b/build.sh
@@ -54,6 +54,9 @@ gl="$(latest_tag golangci/golangci-lint)"
 curl -fsSL "https://github.com/golangci/golangci-lint/releases/download/${gl}/golangci-lint-${gl#v}-linux-${arch}.tar.gz" |
     tar -C /usr/local/bin -xz --strip-components=1 "golangci-lint-${gl#v}-linux-${arch}/golangci-lint"
 
+# --- govulncheck (Go tool) ---------------------------------------------------
+GOBIN=/usr/local/bin go install golang.org/x/vuln/cmd/govulncheck@latest
+
 # --- Hugo (extended) ---------------------------------------------------------
 hv="$(latest_tag gohugoio/hugo)"
 curl -fsSL -o /tmp/hugo.deb \
@@ -128,11 +131,6 @@ rm -rf /usr/share/doc /usr/share/man /usr/share/info /usr/share/lintian
 find /usr/share/locale -mindepth 1 -maxdepth 1 ! -name 'en*' ! -name 'locale.alias' -exec rm -rf {} +
 rm -rf /root/.cache /root/.npm /root/.config /root/go /tmp/* /var/tmp/*
 
-# --- govulncheck (Go tool) ---------------------------------------------------
-# `go install` drops binaries in /root/go/bin, which the cleanup above
-# removes; install into /usr/local/bin so it stays on PATH.
-GOBIN=/usr/local/bin go install golang.org/x/vuln/cmd/govulncheck@latest
-
 # --- sanity ------------------------------------------------------------------
 go version
 govulncheck -version
@@ -169,5 +167,5 @@ test -x /usr/local/sbin/runsvinit
 test -d /etc/service
 
 # The checks above leave caches behind (node compile cache etc).
-rm -rf /tmp/* /var/tmp/* /root/.cache /root/.npm /root/.config /root/go
+rm -rf /tmp/* /var/tmp/* /root/.cache /root/.npm /root/.config
 rm -f "$0"