presubmits:
  kubernetes/kubernetes:
  - name: check-govulncheck-results
    decorate: true
    decoration_config:
      timeout: 5m
    path_alias: k8s.io/kubernetes
    extra_refs:
    - org: kubernetes
       repo: sig-security
       base_ref: main
       workdir: true
    always_run: false
    optional: true
    run_if_changed: '^(go.mod|go.sum|vendor)'
    spec:
      containers:
      - image: golang
        command:
        - /bin/bash
        args:
        - -c
        - |
        - "cd sig-security-tooling/govulncheck/hack/ && ./govulncheck-presubmit.sh"
    annotations:
    testgrid-create-test-group: "true"
    testgrid-dashboards: sig-security-govulncheck-presubmit
    description: Runs `govulncheck` for PRs related to go module changes

          set -euo pipefail

          export WORKDIR=${ARTIFACTS:-$TMPDIR}
          export PATH=$PATH:$GOPATH/bin
          mkdir -p "${WORKDIR}"
          pushd "$WORKDIR"
          go install golang.org/x/vuln/cmd/govulncheck@latest
          popd

          govulncheck -scan module ./... > "${WORKDIR}/head.txt"
          git reset --hard HEAD
          git checkout -b base "${PULL_BASE_SHA}"
          govulncheck -scan module ./... > "${WORKDIR}/pr-base.txt"
          diff -s -u --ignore-all-space "${WORKDIR}"/pr-base.txt "${WORKDIR}"/head.txt || true