Only open govulncheck issues for vulnerabilities we actually call

[Brian Gordon Davis (bgdnext64)]

Stops the GoVulnCheck workflow from opening an issue for vulnerabilities that do not actually affect our code.

The workflow flagged any govulncheck finding, including module-level advisories for dependencies we require transitively but never call. The current trigger is GO-2026-5932 for golang.org/x/crypto/openpgp, which is unmaintained and has Fixed in: N/A. There is no version to bump to, so the auto-created issue (#297) can never be resolved by the "update affected dependencies to their fixed versions" next step.

Running govulncheck -test ./... locally confirms the code is unaffected:

=== Symbol Results ===
No vulnerabilities found.
=== Module Results ===
Vulnerability #1: GO-2026-5932
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.52.0
Fixed in: N/A
Your code is affected by 0 vulnerabilities.

The finding JSON for an uncalled advisory carries only a module frame:

{"osv": "GO-2026-5932", "trace": [{"module": "golang.org/x/crypto", "version": "v0.52.0"}]}

Change

The detection now selects only findings whose call stack reaches a vulnerable symbol (trace[0].function is present), which mirrors govulncheck's own "your code is affected by N vulnerabilities" signal. Uncalled module- and package-level advisories no longer open an issue. Verified against the real govulncheck -test -json ./... output: the old filter matched (would open an issue), the new filter does not.

Once merged, the next scheduled/main run reports found=false and the workflow's existing close step will automatically close#297.

Fixes#297

[Mani Bindra (maniSbindra)]

Linting failed in the merge queue checks : https://github.com/Azure/mpf/actions/runs/30075992349

[Copilot]

Pull request overview

Updates the GoVulnCheck GitHub Actions workflow so it only opens issues for vulnerabilities that are reachable from this repo’s code, avoiding noisy and unactionable issues for transitive module advisories (like openpgp) that are never actually called.

Changes:

• Tighten the workflow’s jq-based detection to only treat findings with a vulnerable symbol call stack as actionable.
• Add in-workflow documentation explaining why module-only advisories should not open issues.
• Update several indirect golang.org/x/* dependency versions in go.mod/go.sum.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/govulncheck.yml	Narrows the “found vulnerabilities” signal to avoid opening issues for module-only findings.
go.mod	Bumps indirect golang.org/x/* dependencies.
go.sum	Updates checksums corresponding to the module version changes.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

go.mod:44

• This PR’s description focuses on changing the govulncheck workflow filtering logic, but it also updates several indirect Go module versions (and the corresponding go.sum entries). If these bumps are intentional/required for the workflow change, please call that out in the PR description; otherwise consider reverting them to keep the change scoped and reduce review/merge noise.

	golang.org/x/crypto v0.54.0 // indirect
golang.org/x/net v0.57.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/text v0.40.0 // indirect