ci: notify Slack when the nightly govulncheck fails

[pratikspatil024]

Summary

Adds a Slack failure notification to Nightly Govulncheck, so a red nightly
reaches #code-releases instead of sitting unseen in the Actions tab.

The job has run nightly since it was added but has never had a failure signal.
It went red on 2026-09-13 with seven standard-library advisories on go1.26.5 and
stayed red for five nights without anyone noticing, while Nightly Race Tests
failures — same repo, same webhook, same channel — get triaged the same morning
they land. The only difference was the notify step.

This mirrors what heimdall-v2 does in its own nightly-govulncheck.yml, so the
two repos report the same way:

• HAS_SLACK_WEBHOOK guard at job level, since secrets cannot be referenced
  from a step-level if.
• continue-on-error: true on the notify step, so a webhook problem never
  masks the real result of the scan.
• The action pinned by commit SHA rather than a floating @v1.
• A workflow_dispatch ref input defaulting to develop, which keeps
  master and release branches scannable on demand without editing the
  workflow. develop stays the only scheduled scope — its dependency set is a
  superset of master's in steady state, and scanning both just doubles the
  Slack volume (ci: scope nightly govulncheck to develop heimdall-v2#648 has the full reasoning).

Executed tests

• Workflow parses as YAML, and the step list resolves in order with the notify
  step last.
• Confirmed SLACK_WEBHOOK is present on this repo, and that the webhook is
  live: Nightly Race Tests failures posted through it to #code-releases on
  2026-08-25, 08-29, 09-02, 09-06 and 09-07, so the guard evaluates true and
  the destination is the intended channel.
• Per GitHub's context reference, inputs is available in both jobs.<id>.name
  and jobs.<id>.steps.with, and is empty for a schedule event, so
  inputs.ref || 'develop' falls back to develop on the nightly trigger.

Not exercised: the scheduled trigger itself and the notify step firing, neither
of which can be observed until a nightly run fails after this merges. The same
inputs.ref fallback merged in heimdall-v2 today and has its first scheduled
run on the same nightly, so if the fallback is wrong it will show up in both at
once — worth a glance at tomorrow's runs.

Rollout notes

CI-only. No consensus, protocol, or operator-facing impact. Expect one Slack
message per failed nightly on #code-releases; with #2420 merged the job
should be green and silent.

---

🤖 Generated with Claude Code

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[Copilot]

🟡 Changes recommended

Two moderate workflow issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds Slack notifications for failed nightly govulncheck runs and supports manually selecting the scanned branch.

Changes:

• Adds a configurable ref input for manual scans.
• Sends guarded, pinned-action Slack alerts.
• Preserves scan failures when notification delivery fails.

File summaries

File	Summary	Findings
.github/workflows/nightly-govulncheck.yml	Updates branch selection and Slack failure reporting.	Concurrency should use the effective scan ref; the Slack payload should safely JSON-encode the ref.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.61%. Comparing base (53cb956) to head (b203013).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #2421   +/-   ##
========================================
  Coverage    55.61%   55.61%           
========================================
  Files          918      918           
  Lines       167138   167138           
========================================
+ Hits         92947    92958   +11     
+ Misses       68722    68718    -4     
+ Partials      5469     5462    -7     

see 23 files with indirect coverage changes
see 23 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🟢 Approval recommended

No unresolved issues were identified.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Lite