[AhmedElBanna80]

Closes #2569

Refs #2579

The govulncheck nightly now proves every Go module on both lane refs, so a dated exception stops passing ON its date for the operator and the gateway as well as templates/go. This must land before 2026-10-25, when the GO-2026-6809 exception expires.

• .github/workflows/govulncheck-nightly.yml: matrix of ref (main, integration/v2) x module (templates/go, packages/kn-next-operator, packages/scale-zero-pg/gateway) on the EXISTING 13 2 * * * cron (unchanged; the cron-staggering test passes). Each leg checks out its ref and runs that ref's own gate script and exceptions file, passing the module being scanned. The file is byte-identical with the one in ci(security): govulncheck every Go module through the fail-closed gate (#2569) #2579.
• Fail-closed: every leg except main x templates/go (main has no Go template yet) FAILS when its go.mod, the gate script or the exceptions file is missing. The operator and gateway exist on main, so they can never skip via hashFiles.
• Choice: I brought the gate to main (the preferred option) rather than failing the main legs: scripts/govulncheck-gate.mjs (with the per-module exception scope from ci(security): govulncheck every Go module through the fail-closed gate (#2569) #2579), security/govulncheck-exceptions.json (the existing GO-2026-6809 entry, no module scope = all modules), and their unit tests.
• Measured on main: the operator is clean apart from GO-2026-6809. The gateway on main (go 1.26, old deps) has 29 called advisories, which would have left the main gateway leg permanently red. So this PR also takes the gateway go.mod, go.sum and Dockerfile as they already are on integration/v2 (go 1.26.9, bumped deps, digest-pinned base). With them the gateway shows only GO-2026-6809 and go build ./... passes.
• Guards: tests/govulncheck-nightly.test.ts (matrix, cron, module argument, require step exempt only for main x templates/go), tests/govulncheck-gate-scope.test.ts, tests/govulncheck-gate.test.ts. Mutation-proved by exit code with exact-once anchors: dropping a module, exempting main for all modules, dropping the module argument, changing the cron, dropping the exceptions check, ignoring the module scope, and not requiring the module were all killed.

Final fix

Typecheck (root tests/) is clean. The gate rejects an exception scope that is not a scanned module (same change as #2579). Main also gets govulncheck-modules.yml (identical to #2579) so PRs touching the operator or gateway are gated at PR time, with the all-modules coverage test. Shared files stay byte-identical with #2579.

Escalation trigger acknowledged: supply chain — extends the vulnerability-scan gate and a CI workflow to all Go modules and brings an already-vetted gateway dependency bump to main; no new credentials or write scopes.

no user-visible surface changed

🤖 Generated with Claude Code

https://claude.ai/code/session_0198oVxWkEEDJJnVhES6ULnx

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
knext-docs	Ready	Preview	Oct 22, 2026 3:49pm UTC