ci(pr-checks): report Go dependency status in the AI review comment

Author: Kbayero

.github/ai-prompts/README.md

@@ -72,11 +72,12 @@ merge `release/**` PRs; see `.github/workflows/README.md` → "Release policy".
 
 ### Routine dependency bumps
 
-A `go_deps` check can enforce that Go modules are on their latest version,
-but it's not currently wired into `pr-checks.yml` (run
-`bash .github/scripts/go-deps.sh --check --discover` manually — see
-`.github/workflows/README.md` → "Dependabot"). Regardless, the
-`architecture` and `security` prompts treat a version bump of
+`pr-checks.yml` already reports outdated Go modules as its own "Go
+dependencies" section in the sticky comment (see
+`.github/workflows/README.md` → "AI review policy") — that's informational
+too, so a dependency bump is expected to still show up there, not something
+these prompts need to flag separately. The `architecture` and `security`
+prompts treat a version bump of
 existing modules as **Tier 1** — not an architectural/agent-breaking change
 and not a vulnerability — and only flag genuine anomalies (new deps, major
 breaking jumps, downgrades, known-vulnerable pins, suspicious `replace`

.github/scripts/post-ai-review-comment.sh

@@ -2,22 +2,33 @@
 set -euo pipefail
 
 # Reads every AI review result JSON (one per prompt, produced by
-# ai-review.sh) and posts/updates a single sticky PR comment with the
-# findings. Purely informational: severity/tier only drive the wording/icon
-# of the comment. This never blocks the merge, never fails the job, and
-# never @mentions anyone — it's just there so the author knows what to fix.
+# ai-review.sh) plus the optional Go dependencies check output, and
+# posts/updates a single sticky PR comment. Purely informational:
+# severity/tier and the deps check result only drive the wording/icon of
+# the comment. This never blocks the merge, never fails the job, and never
+# @mentions anyone — it's just there so the author knows what to fix.
 #
 # Required env vars:
 #   RESULTS_DIR         directory containing one <prompt-name>.json per
 #                       AI prompt (as written by ai-review.sh)
 #   PR_NUMBER           PR number to comment on
 #   GITHUB_REPOSITORY   owner/repo
 #   GITHUB_TOKEN        for posting/updating the comment (unless DRY_RUN=1)
+#
+# Optional env vars:
+#   GO_DEPS_OUTPUT_FILE      path to go-deps.sh's captured stdout+stderr.
+#                            If unset/missing, the Go dependencies section
+#                            is omitted entirely.
+#   GO_DEPS_EXIT_CODE_FILE   path to a file containing go-deps.sh's exit
+#                            code. Required alongside GO_DEPS_OUTPUT_FILE.
 
 : "${RESULTS_DIR:?RESULTS_DIR is required}"
 : "${PR_NUMBER:?PR_NUMBER is required}"
 : "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
 
+GO_DEPS_OUTPUT_FILE="${GO_DEPS_OUTPUT_FILE:-}"
+GO_DEPS_EXIT_CODE_FILE="${GO_DEPS_EXIT_CODE_FILE:-}"
+
 # DRY_RUN=1 prints the comment body instead of calling the GitHub API.
 DRY_RUN="${DRY_RUN:-0}"
 
@@ -129,6 +140,20 @@ if (( ${#results[@]} > 0 )); then
     done
 fi
 
+# Go dependencies — same style as the AI prompt sections above, but not an
+# AI call: just the exit code + output of go-deps.sh, ANSI colors stripped.
+if [[ -n "$GO_DEPS_OUTPUT_FILE" && -f "$GO_DEPS_OUTPUT_FILE" && -n "$GO_DEPS_EXIT_CODE_FILE" && -f "$GO_DEPS_EXIT_CODE_FILE" ]]; then
+    go_deps_exit=$(cat "$GO_DEPS_EXIT_CODE_FILE")
+    go_deps_output=$(sed -E $'s/\x1b\\[[0-9;]*[mK]//g' "$GO_DEPS_OUTPUT_FILE")
+    if [[ "$go_deps_exit" == "0" ]]; then
+        findings_md+=$'\n'"#### 🟢 \`go-deps\` — up to date"$'\n\n'
+        findings_md+="No pending Go dependency updates."$'\n'
+    else
+        findings_md+=$'\n'"#### 🔴 \`go-deps\` — pending updates"$'\n\n'
+        findings_md+='```'$'\n'"$go_deps_output"$'\n''```'$'\n'
+    fi
+fi
+
 if $no_results; then
     header="### ❓ AI review — could not run"
     intro="No AI results were produced. Check the workflow logs."

.github/workflows/README.md

@@ -71,6 +71,11 @@ the comment, never the outcome:
 | Any high/critical finding | 🛑 "High/critical findings" |
 | Tier 3 | 🛑 "Sensitive area, extra care recommended" |
 
+The same comment also carries a **Go dependencies** section (🟢 up to date /
+🔴 pending updates), from a plain `go-deps.sh --check --discover` run — not
+an AI call, just the same informational treatment: it's reported, never
+blocks.
+
 Whatever the signal, the job always succeeds — the status check stays green.
 When the author pushes new commits, the sticky comment is **updated
 in-place** (same comment, no stacking) and the workflow re-runs
@@ -97,10 +102,11 @@ behavior is ever needed again.)
 ### Dependabot
 
 Disabled. `.github/dependabot.yml` keeps `updates: []` so Dependabot
-reads the file but creates no PRs. Dependency freshness used to be enforced
-on every PR via a `go_deps` check; it's no longer wired into `pr-checks.yml`
-(see [Reusable workflows](#reusable-workflows)) — run
-`bash .github/scripts/go-deps.sh --check --discover` manually instead. To
+reads the file but creates no PRs. Dependency freshness is surfaced instead
+by the "Check Go dependencies" step in `pr-checks.yml`, which runs
+`bash .github/scripts/go-deps.sh --check --discover` and reports the result
+as a section in the sticky comment (informational — see
+[AI review policy](#ai-review-policy-informational-only-no-auto-merge)). To
 re-enable Dependabot, restore the
 previous `updates:` list (see git history of that file).
 
@@ -176,12 +182,17 @@ at all.
 
 ### Steps
 
-1. **Fetch the diff** — `gh pr diff` (same unified diff the GitHub UI
+1. **Check Go dependencies** — `actions/setup-go@v5`, then (if `API_SECRET`
+   is set) configures git for private `utmstack/*` modules, then runs
+   `bash .github/scripts/go-deps.sh --check --discover`. Captures stdout,
+   stderr and the exit code to `/tmp/go-deps/`; **never fails the job** —
+   `set +e` around the call, same informational treatment as the AI review.
+2. **Fetch the diff** — `gh pr diff` (same unified diff the GitHub UI
    shows — no need for `fetch-depth: 0`).
-2. **Filter the diff** — drops any file under a `rules/`, `filters/` or
+3. **Filter the diff** — drops any file under a `rules/`, `filters/` or
    `definitions/` folder (detection rules / correlation filters / content,
    not code) before the AI ever sees it.
-3. **Run AI review, once per prompt** — for each `.md` under
+4. **Run AI review, once per prompt** — for each `.md` under
    `.github/ai-prompts/` (except `README.md`), calls
    `.github/scripts/ai-review.sh`, which:
    - Calls the **ThreatWinds AI** `/chat/completions` endpoint with the
@@ -206,9 +217,10 @@ at all.
    `.github/ai-prompts/` — the loop in `pr-checks.yml` discovers it at
    runtime, no YAML changes needed. **Default model:** `gemini-3-flash-lite`;
    each prompt can pin its own in frontmatter (`model: gemini-3-pro`, etc.).
-4. **Post the comment** — `.github/scripts/post-ai-review-comment.sh` reads
-   every JSON file, builds one combined markdown comment (severity/tier
-   only drive wording/icon), and upserts a single sticky comment (marker
+5. **Post the comment** — `.github/scripts/post-ai-review-comment.sh` reads
+   every JSON file plus the Go deps output/exit code, builds one combined
+   markdown comment (severity/tier and the deps exit code only drive
+   wording/icon), and upserts a single sticky comment (marker
    `<!-- approver:ai -->`, kept from the previous design so in-flight PRs
    keep updating the same comment). Never fails, never blocks, never
    @mentions anyone.
@@ -343,7 +355,7 @@ The installer is uploaded as a release asset.
 
 | Secret | Used in | Description |
 |--------|---------|-------------|
-| `API_SECRET` | v10, v11 deploy, installer | GitHub PAT with `read:org` scope. Used by deployment workflows for team-membership validation and for fetching private `utmstack/*` Go modules. **Not used by `pr-checks.yml`** — that workflow has no team-membership check. |
+| `API_SECRET` | v10, v11 deploy, installer, pr-checks | GitHub PAT with `read:org` scope. Used by deployment workflows for team-membership validation, and by `pr-checks.yml`'s "Check Go dependencies" step to fetch private `utmstack/*` Go modules via `go list`. **Not used for any team-membership check in `pr-checks.yml`** — that workflow has none. |
 | `AGENT_SECRET_PREFIX` | v10, v11 | Agent encryption key |
 | `SIGN_CERT` | v10, v11 | Code signing certificate path (it's a `var`) |
 | `SIGN_KEY` | v10, v11 | Code signing key |
@@ -371,11 +383,12 @@ The installer is uploaded as a release asset.
 
 **PR checks:**
 
-- `_pr-reusable-go-deps.yml` — runs `go-deps.sh --check --discover` at repo
-  level and uploads `go-deps-result` as an artifact. **Not called by
-  `pr-checks.yml`** (removed — see [Dependabot](#dependabot)); kept for
-  running manually on demand via `workflow_call` or a local invocation of
-  the underlying script.
+- `_pr-reusable-go-deps.yml` — a leftover, artifact-based version of the Go
+  deps check (uploads `go-deps-result` instead of reporting inline). **Not
+  called by `pr-checks.yml`** — `pr-checks.yml` runs
+  `bash .github/scripts/go-deps.sh --check --discover` directly as a step
+  instead (see [PR Checks](#pr-checks)). Kept only for manually invoking via
+  `workflow_call` if you ever need the artifact form again.
 - The AI review + comment logic used to be two more reusable workflows
   (`_pr-reusable-ai-review.yml`, `_pr-reusable-approver.yml`); both were
   removed and folded into steps of the single `review` job in
@@ -467,9 +480,11 @@ git checkout -b hotfix/auth-bug
   [AI review policy](#ai-review-policy-informational-only-no-auto-merge).
   Those branches are gated by the "Protect Main" GitHub ruleset instead.
 
-**`go_deps` fails with "Could not inspect ... run 'go mod tidy' there":**
+**Go dependencies section shows 🔴 "Could not inspect ... run 'go mod tidy' there":**
 - `go.sum` is out of sync, typically due to local `replace` directives in
-  `packages/`. Run `go mod tidy` in the affected module and commit.
+  `packages/`. Run `go mod tidy` in the affected module and commit. This
+  never fails the job — it's reported in the comment, same as any other
+  finding.
 
 **Build failures:**
 - Check that all required secrets are configured.

.github/workflows/pr-checks.yml

@@ -20,6 +20,33 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.23'
+
+      - name: Configure git for private Go modules
+        if: ${{ env.HAS_API_SECRET == 'true' }}
+        env:
+          HAS_API_SECRET: ${{ secrets.API_SECRET != '' }}
+          API_SECRET: ${{ secrets.API_SECRET }}
+        run: |
+          git config --global url."https://${API_SECRET}:x-oauth-basic@github.com/".insteadOf "https://github.com/"
+          {
+            echo "GOPRIVATE=github.com/utmstack"
+            echo "GONOPROXY=github.com/utmstack"
+            echo "GONOSUMDB=github.com/utmstack"
+          } >> "$GITHUB_ENV"
+
+      - name: Check Go dependencies
+        run: |
+          mkdir -p /tmp/go-deps
+          set +e
+          bash .github/scripts/go-deps.sh --check --discover \
+            > /tmp/go-deps/output.txt 2>&1
+          echo $? > /tmp/go-deps/exit_code.txt
+          set -e
+          cat /tmp/go-deps/output.txt
+
       - name: Fetch PR diff
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -77,6 +104,8 @@ jobs:
       - name: Post AI review comment
         env:
           RESULTS_DIR: /tmp/ai-results
+          GO_DEPS_OUTPUT_FILE: /tmp/go-deps/output.txt
+          GO_DEPS_EXIT_CODE_FILE: /tmp/go-deps/exit_code.txt
           PR_NUMBER: ${{ github.event.pull_request.number }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}