Answer architecture round 1: 0 🔴, 5 🟡; a job of its own that only releases wait for, filing each vulnerability atop the plan by a pull request, a recorded decision, one gate list, and Renovate on the go run tools

.github/workflows/test.yml

@@ -14,6 +14,7 @@ permissions:
 jobs:
   test:
     name: vet + fmt + tests
+    if: github.event_name != 'schedule'
     runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v7
@@ -22,7 +23,6 @@ jobs:
           fetch-depth: 0
       - name: Relevant changes
         id: changes
-        if: github.event_name != 'schedule'
         run: |
           if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
             git fetch --no-tags origin "$GITHUB_BASE_REF"
@@ -42,7 +42,6 @@ jobs:
           fi
           echo "base=$base" >> "$GITHUB_OUTPUT"
       - name: CHANGELOG entry for data changes
-        if: github.event_name != 'schedule'
         run: |
           base='${{ steps.changes.outputs.base }}'
           if ! git diff --quiet "$base"...HEAD -- data testdata/shipped_shape.txt && git diff --quiet "$base"...HEAD -- CHANGELOG.md; then
@@ -59,11 +58,6 @@ jobs:
       - name: Lowest supported Go
         if: ${{ !cancelled() && steps.changes.outputs.code == 'true' }}
         run: docker build --build-arg GO_VERSION=1.22.12 --target portable .
-      # Runs on every event, and daily, since a vulnerability is published without a change
-      # here; `--no-cache-filter` keeps a cached pass from hiding one.
-      - name: Known vulnerabilities in this Go release and the module
-        if: ${{ !cancelled() }}
-        run: docker build --no-cache-filter vulnerabilities --target vulnerabilities .
       - name: Package repositories, signed with throwaway keys
         if: ${{ !cancelled() && steps.changes.outputs.packaging == 'true' }}
         run: |
@@ -72,9 +66,45 @@ jobs:
             docker build -f release-tooling/package-repos.Dockerfile --target checks \
             --secret id=gpg,env=PACKAGES_GPG_KEY --secret id=rsa,env=PACKAGES_RSA_KEY .
 
+  # Not a required check: a vulnerability published in Go, or an outage of vuln.go.dev,
+  # holds the release but no merge.
+  vulnerabilities:
+    name: Known vulnerabilities in this Go release and the module
+    runs-on: ubuntu-26.04
+    timeout-minutes: 10
+    permissions:
+      actions: write
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - run: docker build --no-cache-filter vulnerabilities --target vulnerability-report --output "$RUNNER_TEMP/vulnerabilities" .
+      - name: File each one in todo.md
+        id: file
+        run: python3 release-tooling/file_vulnerabilities.py "$RUNNER_TEMP/vulnerabilities/report.json" todo.md
+      # A pull request the workflow's token opens starts no workflow, so this starts the tests.
+      - name: Propose the filed items
+        if: failure() && steps.file.outcome == 'failure' && github.event_name != 'pull_request'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if git diff --quiet todo.md || git ls-remote --exit-code --heads origin vulnerabilities; then
+            exit 0
+          fi
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git switch -c vulnerabilities
+          git commit -qam "File the known vulnerabilities govulncheck reports"
+          git push -q "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" vulnerabilities
+          gh pr create --head vulnerabilities --title "File the known vulnerabilities govulncheck reports" \
+            --body "govulncheck reports known vulnerabilities in the Go release or the module, and no release is cut until they are gone. This files them atop the next release in todo.md; the fix is the bump its item names."
+          gh workflow run test.yml --ref vulnerabilities
+
   release:
     name: Release from CHANGELOG.md
-    needs: test
+    needs: [test, vulnerabilities]
     if: github.event_name == 'push'
     runs-on: ubuntu-26.04
     permissions: