govulncheck is blind to build-tool dependencies (buf, golangci-lint, mockery)

[lklimek]

Summary

The govulncheck CI job is marked as a gating check, but it never scans the Buf CLI, golangci-lint, or mockery dependency trees. A critical advisory in any of those would pass the gate silently.

Cause

Makefile:279 runs:

go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./...

Developer tools are tracked in tools/tools.go, which is guarded by //go:build tools. Without that build tag, the tool imports are excluded from the package graph entirely, so ./... never resolves them.

Evidence

$ go list -deps -buildvcs=false ./...                   | grep -c bufbuild
0
$ go list -deps -buildvcs=false -tags tools ./tools/... | grep -c bufbuild
1

Zero bufbuild packages in the graph govulncheck actually scans.

Impact

Low direct risk — these are build-time tools, not linked into shipped binaries — but the gate currently implies coverage it does not provide. Buf in particular is guarded by exactly one control today (Dependabot freshness), which is not a vulnerability control: upstream bufbuild/buf has no SECURITY.md, no disclosure contact, and has never registered an advisory, so a clean database result carries little evidentiary weight.

Suggested fix

Add -tags tools to the govulncheck invocation in Makefile:279:

go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 -tags tools ./...

Land this deliberately — it will likely surface findings in the golangci-lint and mockery graphs on first run, which need triaging (most will be unreachable build-time-only paths).

Context

Found while auditing #1397 (bufbuild/buf 1.71.0 → 1.72.0).

_{🤖 Reported by Claudius the Magnificent AI Agent}