[AhmedElBanna80]

Refs #2569

govulncheck (pinned v1.9.0, fail-closed gate, set -euo pipefail) now covers every Go module, not only templates/go. The nightly half lands on main in #2581 (which closes #2569).

• New .github/workflows/govulncheck-modules.yml: matrix over packages/kn-next-operator and packages/scale-zero-pg/gateway, on PRs and pushes touching the module, the gate/exceptions files and the gate tests. Read-only permissions, SHA-pinned actions. templates/go stays gated in go-template.yml.
• security/govulncheck-modules.json: explicit exclusion list, read by the test. spikes/zone-functions-coldstart/fn-go is excluded with a reason: throwaway benchmark spike pinned to go 1.26.0, 8 called stdlib advisories, never shipped.
• tests/govulncheck-all-modules.test.ts: every tracked go.mod must be gated in a workflow or excluded with a reason.

Measured locally (govulncheck v1.9.0 through the gate): operator, gateway and templates/go each show only GO-2026-6809 (covered by the existing exception expiring 2026-10-25). No new exception needed.

Round 2

• Exceptions are scoped per module. Each entry in security/govulncheck-exceptions.json takes an optional modules: [...] (module directories); omitted means all modules, so the GO-2026-6809 entry is unchanged. scripts/govulncheck-gate.mjs takes the module being scanned (argument or GOVULNCHECK_MODULE, and REFUSES to run without it) and applies the "covers this finding" and "stale" checks only to in-scope entries. Every gated step passes the module (go-template.yml, govulncheck-modules.yml, the nightly). New tests/govulncheck-gate-scope.test.ts: an operator-scoped entry does not make the gateway stale; an out-of-scope entry does not excuse a finding; an in-scope stale entry still fails.
• Coverage-guard hole fixed: the nightly no longer counts as gating. Each module must be gated by at least one PR/push workflow that is not the nightly, with a path filter covering it; the nightly must in addition scan every gated module. The new workflow's paths include tests/govulncheck-gate.test.ts (and the scope test).
• The nightly is now a ref x module matrix (same 13 2 * * * cron), identical to the file in ci(security): govulncheck nightly over every Go module and both refs (#2569) #2581 so the two refs stay byte-identical; its require step FAILS every leg except main x templates/go.
• Mutation-proved by exit code with exact-once anchors, all killed: scope ignored, out-of-scope still covering, in-scope stale unreported, CLI module not required, deleting the go-template.yml govulncheck step, dropping the module argument, dropping a nightly module, exempting main for all modules, changing the cron.
• Main-side follow-up for the nightly: ci(security): govulncheck nightly over every Go module and both refs (#2569) #2581.

Final fix

Typecheck (root tests/) is clean: the gate carries JSDoc types and the nightly test types the module axis. The gate now rejects an exception scope that is not a scanned module (trailing slash, ./ prefix, no go.mod, or listed as excluded), via knownModules, so an unscanned scope can no longer linger. Mutation-proved. Shared files stay byte-identical with #2581.

Escalation trigger acknowledged: supply chain — extends the vulnerability-scan gate and CI workflows to all Go modules; no new credentials or write scopes.

no user-visible surface changed

🤖 Generated with Claude Code

https://claude.ai/code/session_0198oVxWkEEDJJnVhES6ULnx

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
knext-docs	Ready	Preview	Oct 22, 2026 3:49pm UTC