fix(fix-vulnerabilities): avoid divergent branches from previous runs

.github/workflows/fix-vulnerabilities.yaml

@@ -86,11 +86,12 @@ jobs:
 
       - name: Create new branch
         id: create_branch
+        env:
+          base: ${{ needs.gather_facts.outputs.branch }}
         run: |
-          branch="remediate-vulnerabilities-${{ needs.gather_facts.outputs.branch }}"
+          branch="remediate-vulnerabilities-${base}"
           echo "branch=${branch}" >> $GITHUB_OUTPUT
           git checkout -b "${branch}"
-          git pull origin "${branch}" || true
 
       - name: Run nancy-fixer fix
         uses: docker://gsoci.azurecr.io/giantswarm/nancy-fixer:0.10.1
@@ -123,17 +124,22 @@ jobs:
         if: "${{ steps.commit_changes.outputs.skip != 'true' }}"
         env:
           remote_repo: "https://${{ github.actor }}:${{ steps.generate_token.outputs.token }}@github.com/${{ github.repository }}.git"
+          branch: ${{ steps.create_branch.outputs.branch }}
         run: |
-          git push "${remote_repo}" HEAD:"${{ steps.create_branch.outputs.branch }}"
+          git push --force "${remote_repo}" HEAD:"${branch}"
 
       - name: Create pull request
         env:
           GITHUB_TOKEN: "${{ steps.generate_token.outputs.token }}"
+          branch: ${{ steps.create_branch.outputs.branch }}
+          base: ${{ needs.gather_facts.outputs.branch }}
         if: "${{ steps.commit_changes.outputs.skip != 'true' }}"
         run: |
-          gh pr create \
-            --title "fix(nancy): remediate findings on ${{ needs.gather_facts.outputs.branch }}" \
-            --body "Fix Nancy findings on branch ${{ needs.gather_facts.outputs.branch }}" \
-            --head "${{ steps.create_branch.outputs.branch }}" \
-            --base "${{ needs.gather_facts.outputs.branch }}"
-          gh pr merge --auto --squash
+          if [ -z "$(gh pr list --head "${branch}" --state open --json number --jq '.[0].number')" ]; then
+            gh pr create \
+              --title "fix(nancy): remediate findings on ${base}" \
+              --body "Fix Nancy findings on branch ${base}" \
+              --head "${branch}" \
+              --base "${base}"
+          fi
+          gh pr merge --auto --squash "${branch}"

CHANGELOG.md

@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 however this project does not use Semantic Versioning and there are no releases.
 Instead this file uses a date-based structure.
 
+## 2026-07-07
+
+### Fixed
+
+- `fix-vulnerabilities.yaml` — the nancy remediation job no longer fails to push when a previous run's PR is still open. The stable, regenerated `remediate-vulnerabilities-<base>` branch had divergent history, so the plain push was rejected. Dropped the silently-failing `git pull`, switched to `git push --force`, and made `gh pr create` idempotent.
+
 ## 2026-07-06
 
 ### Fixed