From 592570a73f352a9ffd1975ebd7f58176a462d8cc Mon Sep 17 00:00:00 2001
From: Franco <franco@giantswarm.io>
Date: Tue, 7 Jul 2026 11:29:05 -0300
Subject: [PATCH 1/2] fix(fix-vulnerabilities): avoid divergent branches from
 previous runs

---
 .github/workflows/fix-vulnerabilities.yaml | 19 +++++++++++--------
 CHANGELOG.md                               |  6 ++++++
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/fix-vulnerabilities.yaml b/.github/workflows/fix-vulnerabilities.yaml
index b627c35..a7e5fd8 100644
--- a/.github/workflows/fix-vulnerabilities.yaml
+++ b/.github/workflows/fix-vulnerabilities.yaml
@@ -90,7 +90,6 @@ jobs:
           branch="remediate-vulnerabilities-${{ needs.gather_facts.outputs.branch }}"
           echo "branch=${branch}" >> $GITHUB_OUTPUT
           git checkout -b "${branch}"
-          git pull origin "${branch}" || true
 
       - name: Run nancy-fixer fix
         uses: docker://gsoci.azurecr.io/giantswarm/nancy-fixer:0.10.1
@@ -124,16 +123,20 @@ jobs:
         env:
           remote_repo: "https://${{ github.actor }}:${{ steps.generate_token.outputs.token }}@github.com/${{ github.repository }}.git"
         run: |
-          git push "${remote_repo}" HEAD:"${{ steps.create_branch.outputs.branch }}"
+          git push --force "${remote_repo}" HEAD:"${{ steps.create_branch.outputs.branch }}"
 
       - name: Create pull request
         env:
           GITHUB_TOKEN: "${{ steps.generate_token.outputs.token }}"
         if: "${{ steps.commit_changes.outputs.skip != 'true' }}"
         run: |
-          gh pr create \
-            --title "fix(nancy): remediate findings on ${{ needs.gather_facts.outputs.branch }}" \
-            --body "Fix Nancy findings on branch ${{ needs.gather_facts.outputs.branch }}" \
-            --head "${{ steps.create_branch.outputs.branch }}" \
-            --base "${{ needs.gather_facts.outputs.branch }}"
-          gh pr merge --auto --squash
+          branch="${{ steps.create_branch.outputs.branch }}"
+          base="${{ needs.gather_facts.outputs.branch }}"
+          if [ -z "$(gh pr list --head "${branch}" --state open --json number --jq '.[0].number')" ]; then
+            gh pr create \
+              --title "fix(nancy): remediate findings on ${base}" \
+              --body "Fix Nancy findings on branch ${base}" \
+              --head "${branch}" \
+              --base "${base}"
+          fi
+          gh pr merge --auto --squash "${branch}"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e70b1b4..7d23d35 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 however this project does not use Semantic Versioning and there are no releases.
 Instead this file uses a date-based structure.
 
+## 2026-07-07
+
+### Fixed
+
+- `fix-vulnerabilities.yaml` — the nancy remediation job no longer fails to push when a previous run's PR is still open. The stable, regenerated `remediate-vulnerabilities-<base>` branch had divergent history, so the plain push was rejected. Dropped the silently-failing `git pull`, switched to `git push --force`, and made `gh pr create` idempotent.
+
 ## 2026-07-06
 
 ### Fixed

From 5f6fd1fad53566d00feda99eb1c489915002e825 Mon Sep 17 00:00:00 2001
From: Franco <franco@giantswarm.io>
Date: Tue, 7 Jul 2026 12:07:06 -0300
Subject: [PATCH 2/2] fix: remediate zizmor findings

---
 .github/workflows/fix-vulnerabilities.yaml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/fix-vulnerabilities.yaml b/.github/workflows/fix-vulnerabilities.yaml
index a7e5fd8..eda6384 100644
--- a/.github/workflows/fix-vulnerabilities.yaml
+++ b/.github/workflows/fix-vulnerabilities.yaml
@@ -86,8 +86,10 @@ jobs:
 
       - name: Create new branch
         id: create_branch
+        env:
+          base: ${{ needs.gather_facts.outputs.branch }}
         run: |
-          branch="remediate-vulnerabilities-${{ needs.gather_facts.outputs.branch }}"
+          branch="remediate-vulnerabilities-${base}"
           echo "branch=${branch}" >> $GITHUB_OUTPUT
           git checkout -b "${branch}"
 
@@ -122,16 +124,17 @@ jobs:
         if: "${{ steps.commit_changes.outputs.skip != 'true' }}"
         env:
           remote_repo: "https://${{ github.actor }}:${{ steps.generate_token.outputs.token }}@github.com/${{ github.repository }}.git"
+          branch: ${{ steps.create_branch.outputs.branch }}
         run: |
-          git push --force "${remote_repo}" HEAD:"${{ steps.create_branch.outputs.branch }}"
+          git push --force "${remote_repo}" HEAD:"${branch}"
 
       - name: Create pull request
         env:
           GITHUB_TOKEN: "${{ steps.generate_token.outputs.token }}"
+          branch: ${{ steps.create_branch.outputs.branch }}
+          base: ${{ needs.gather_facts.outputs.branch }}
         if: "${{ steps.commit_changes.outputs.skip != 'true' }}"
         run: |
-          branch="${{ steps.create_branch.outputs.branch }}"
-          base="${{ needs.gather_facts.outputs.branch }}"
           if [ -z "$(gh pr list --head "${branch}" --state open --json number --jq '.[0].number')" ]; then
             gh pr create \
               --title "fix(nancy): remediate findings on ${base}" \