ci: enforce the DGXC Go proxy in the verification workflow

Flips the main-only verification workflow from `routed` to `enforced`:
GOPROXY carries no `,direct` fallback, so a module Artifactory does not
serve is a hard failure rather than a silent fetch from the public
internet. No build, release, or PR is affected — the workflow verifies a
property and ships nothing.

`routed` falls through on 404/410, so a module Artifactory did not carry
resolved publicly and the check still went green. We knew nothing was
rejected; we did not know everything came from Artifactory. Removing the
fallback makes the workflow its own coverage measurement, because with no
fallback and a cold cache there is nowhere else a module can come from.

That only holds if the job actually fetches, which the first six attempts
did not establish. Five ways it could report success without measuring
anything were found in review and closed:

  - A restored 608 MB setup-go cache satisfied `go mod download` with zero
    fetches. Fixed with cache: false plus an explicit cold-cache assertion.
  - The `,direct` check was narrower than the property: an
    `<artifactory>,<other-proxy>` value still falls through on 404. Now
    requires an exact match on the full expected URL, repo key included,
    which also closes the -cdn variants that can hand off to another origin.
  - `go mod download -x` logs the URL Go requested and follows redirects
    inside http.Client.Do, so a 3xx to another host was invisible to the
    counters. Added a curl canary measuring the final destination.
  - That canary then had the same defect one layer down: without a status
    check, a 401 or 404 reports zero redirects from the Artifactory host.
    Now requires HTTP 200 first.
  - `read < <(curl ...)` returns read's status and discards curl's, so a
    body truncated after a 200 header still passed. Now uses command
    substitution with an explicit status capture.

Declined a network-layer outbound-host allowlist: disproportionate for a
workflow that ships nothing, and the canary covers the realistic slice.

Verified on a cold cache with a single-entry GOPROXY: 224 module zips
served 200 by Artifactory — matching the 224 modules in
vendor/modules.txt — across requests that reached no other host, with the
regenerated vendor/ byte-identical to what is committed.

The file header records that this workflow is temporary and names the
three things that migrate when #2374 deletes it: mode: enforced,
id-token: write plus the teardown, and the GOPROXY assertion. Everything
else exists only because this job builds nothing; a real build fails on
its own when the proxy cannot serve it.

Closes #2375

Signed-off-by: Mark Chmarny <mark@chmarny.com>

Author: mchmarny

.github/workflows/dgxc-goproxy-probe.yaml

@@ -25,12 +25,48 @@
 # `refs/pull/N/merge` instead and cannot validate the identity mapping the
 # exchange actually matches on.
 #
-# What a green run proves: the OIDC exchange mints a token, GOPROXY is ordered
-# with Artifactory first, GOSUMDB verification is intact, and a real module graph
-# resolves. What it does NOT prove: coverage. Under `routed` the resolver falls
-# through to `direct` on 404/410, so a module Artifactory does not carry is
-# fetched from the public internet and the build still goes green. Only
-# `enforced` closes that, and only once the graph is known to be served.
+# Runs in `enforced` mode: GOPROXY carries no `,direct` fallback, so a module
+# Artifactory does not serve is a hard failure rather than a silent fetch from
+# the public internet.
+#
+# That also makes this workflow its own coverage measurement. Under `routed` a
+# green run proved only that nothing was *rejected*; a 404 fell through and the
+# build still passed, so coverage was unknown. With the fallback gone, a green
+# run means every module in the resolved graph came from Artifactory — there is
+# nowhere else it could have come from. No separate reporting step is needed:
+# the failure mode names the unserved module directly.
+#
+# Safe to enforce here first because nothing depends on this workflow. It
+# verifies a property; it does not build or ship anything. If Artifactory turns
+# out not to serve some module, the blast radius is one red check on main.
+#
+# ---------------------------------------------------------------------------
+# THIS FILE IS TEMPORARY. Delete it as part of #2374.
+#
+# Almost every assertion below exists because this workflow builds nothing:
+# `cache: false`, the cold-cache check, the download count, and the archive
+# canary all answer "did anything actually happen?" A real build answers that
+# by existing — if Artifactory cannot serve a module, `go build` fails. The
+# build is the assertion.
+#
+# When #2374 lands and real jobs resolve through the proxy, carry over only:
+#
+#   - `mode: enforced` on the action
+#   - `id-token: write` and the credential teardown step
+#   - the GOPROXY assertion (exact match, single entry)
+#
+# That last one is the only guard worth keeping, because it catches what a
+# build cannot: the action silently no-opping, or a revert to `routed`. Either
+# looks perfectly healthy while routing nothing.
+#
+# Everything else dies with this file. The vendor-equivalence and
+# resolver-posture steps in particular exist only because the repo vendors,
+# which is the thing #2374 removes.
+#
+# If a proxy canary is still wanted afterwards, write a new ~20-line
+# dispatch-only one. Its job is separating "the proxy is broken" from "the code
+# is broken" when a build fails — an ops tool, not this measurement rig.
+# ---------------------------------------------------------------------------
 name: DGXC Go Proxy Probe
 
 on:
@@ -87,14 +123,25 @@ jobs:
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5  # v6.2.0
         with:
           go-version-file: go.mod
+          # Required for this workflow to measure anything. setup-go caches
+          # GOMODCACHE and GOCACHE by default, and the proxy action sets
+          # GOFLAGS=-mod=readonly so Go reads the module cache rather than
+          # vendor/. A cache restored from an earlier run therefore satisfies
+          # `go mod download` without contacting Artifactory at all, and the
+          # job goes green having proven nothing.
+          #
+          # This is not hypothetical: the first enforced run here hit a 608 MB
+          # cache and emitted zero `go: downloading` lines. Every other job in
+          # the repo should keep caching; this one exists to force real fetches.
+          cache: false
 
       # No tooling is installed in this job, so rule 4 ("install tooling before
       # configuring the proxy") is satisfied trivially. That is not true of
       # go-test, which is why wiring it is a separate, later step.
       - name: Configure the DGXC Go proxy
         uses: ./.github/actions/setup-dgxc-goproxy
         with:
-          mode: routed
+          mode: enforced
 
       # Non-optional. GOPROXY is an ordered list and Go consults later entries
       # only on 404/410, so `proxy.golang.org,<artifactory>,direct` looks routed,
@@ -109,12 +156,94 @@ jobs:
           case "${proxy}" in
             *"|"*) echo "GOPROXY uses '|', which falls through on 401/403. Use ','."; exit 1 ;;
           esac
-          case "${proxy%%,*}" in
+          # Exact match, not a host prefix. The `-cdn` repository variants are
+          # the one documented path on which Artifactory hands a client off to
+          # another origin (Direct Download), so pinning the repo key and not
+          # just the host closes it. Upstream F-009 records that Direct
+          # Download never engages for Go anyway — no module archive
+          # approaches its 100 MB threshold — but the assertion costs nothing.
+          expected="https://edge.urm.nvidia.com/artifactory/api/go/dgxc-go-virtual"
+          [ "${proxy}" = "${expected}" ] \
+            || { echo "GOPROXY is '${proxy}', expected exactly '${expected}'"; exit 1; }
+          [ "$(go env GOSUMDB)" != off ] || { echo "GOSUMDB=off"; exit 1; }
+          # Enforced means no fallback at all. Reject any comma rather than
+          # just `,direct`: Go consults later entries on 404/410 whatever they
+          # are, so `<artifactory>,https://proxy.golang.org` falls through to
+          # the public internet exactly like `,direct` would.
+          case "${proxy}" in
+            *,*) echo "GOPROXY has more than one entry ('${proxy}'); this is not enforced"; exit 1 ;;
+          esac
+          echo "OK: Artifactory is the only GOPROXY entry and GOSUMDB is intact"
+
+      # `go mod download -x` traces the URL Go *requested*, and http.Client.Do
+      # follows redirects inside that call, logging the final status against
+      # the original URL. So the download counters below cannot see a 3xx that
+      # hands the transfer to another origin: `served` would increment and
+      # `other` stay zero while the bytes came from elsewhere.
+      #
+      # Redirect behavior is a repository-level setting rather than per-module,
+      # so one request is a representative canary. The credential comes from
+      # the GOAUTH helper via curl --config so the token never reaches argv,
+      # where a process listing would expose it.
+      - name: Assert Artifactory serves bytes rather than redirecting
+        shell: bash
+        run: |
+          url="https://edge.urm.nvidia.com/artifactory/api/go/dgxc-go-virtual/gopkg.in/yaml.v2/@v/v2.4.0.zip"
+          auth="$("${GOAUTH}" | grep -i '^Authorization:')"
+          [ -n "${auth}" ] || { echo "::error::GOAUTH helper produced no Authorization header"; exit 1; }
+
+          # Command substitution with an explicit status capture, not process
+          # substitution. `read < <(...)` returns read's own status and
+          # discards curl's, so a transfer that fails *after* the response
+          # headers — a truncated body, exit 18 or 56 — still emits
+          # `%{http_code} 200` and every assertion below passes on a fetch
+          # that did not complete. Verified: a simulated exit 56 after output
+          # is silently accepted under process substitution and caught here.
+          #
+          # `|| rc=$?` keeps the assignment from tripping `set -e` before the
+          # status can be inspected, and the here-string below supplies the
+          # trailing newline `read` needs to avoid returning non-zero at EOF.
+          rc=0
+          out="$(
+            printf 'header = "%s"\nurl = "%s"\n' "${auth}" "${url}" \
+              | curl --config - -sSL --max-time 60 -o /dev/null \
+                     -w '%{http_code} %{num_redirects} %{url_effective}'
+          )" || rc=$?
+          [ "${rc}" -eq 0 ] \
+            || { echo "::error::curl exited ${rc}; the transfer did not complete"; exit 1; }
+          read -r status redirects effective <<<"${out}"
+          echo "status: ${status}"
+          echo "redirects: ${redirects}"
+          echo "final URL host: $(printf '%s' "${effective}" | sed -E 's#^https?://([^/]+)/.*#\1#')"
+
+          # Status first. Without it a 401 or 404 also reports zero redirects
+          # from the Artifactory host, so the two checks below would pass on a
+          # response that carried no archive at all — the same shape of false
+          # pass this canary was added to close.
+          [ "${status}" = "200" ] \
+            || { echo "::error::archive probe returned HTTP ${status}, not 200; nothing was served"; exit 1; }
+          [ "${redirects}" -eq 0 ] \
+            || { echo "::error::Artifactory redirected ${redirects} time(s) to ${effective}"; exit 1; }
+          case "${effective}" in
             https://edge.urm.nvidia.com/*) ;;
-            *) echo "first GOPROXY entry is '${proxy%%,*}', not Artifactory"; exit 1 ;;
+            *) echo "::error::bytes came from ${effective}, not Artifactory"; exit 1 ;;
           esac
-          [ "$(go env GOSUMDB)" != off ] || { echo "GOSUMDB=off"; exit 1; }
-          echo "OK: Artifactory is first in GOPROXY and GOSUMDB is intact"
+          echo "OK: Artifactory served the archive directly (HTTP 200, no redirect to another origin)"
+
+      # Guards the guard. Both assertions above are satisfied by a job that
+      # never fetches anything, which is how the first enforced run passed on a
+      # restored module cache. Coverage is only demonstrated if modules were
+      # actually pulled through Artifactory.
+      - name: Assert the module cache is cold
+        shell: bash
+        run: |
+          modcache="$(go env GOMODCACHE)"
+          if [ -d "${modcache}/cache/download" ] \
+             && [ -n "$(find "${modcache}/cache/download" -name '*.zip' -print -quit 2>/dev/null)" ]; then
+            echo "::error::module cache is already populated at ${modcache}; this run cannot demonstrate proxy coverage"
+            exit 1
+          fi
+          echo "OK: module cache is cold, so anything resolved below came over the wire"
 
       # The real work. `go mod download` resolves from go.mod/go.sum rather
       # than reading vendor/, so it is a genuine application-dependency fetch
@@ -132,7 +261,27 @@ jobs:
       # needs.
       - name: Resolve the module graph through the proxy
         shell: bash
-        run: go mod download
+        run: |
+          go mod download -x 2>&1 | tee /tmp/godownload.log
+
+          # `-x` traces every request as `# get <url>` and its response as
+          # `# get <url>: <status>`. With a cold cache and a single-entry
+          # GOPROXY, counting module zips Artifactory served 200 *is* the
+          # coverage measurement — there is no other source they could have
+          # come from.
+          served="$(grep -cE '# get https://edge\.urm\.nvidia\.com/.*\.zip: 200 OK' /tmp/godownload.log || true)"
+          other="$(grep -oE '# get https://[a-z0-9.-]+/' /tmp/godownload.log \
+                     | grep -vc 'edge\.urm\.nvidia\.com' || true)"
+          echo "module zips served by Artifactory: ${served}"
+          echo "requests to other hosts: ${other}"
+
+          # Zero fetches is the signature of the false pass this workflow
+          # exists to prevent: every assertion above is satisfied by a job
+          # that never contacted anything.
+          [ "${served}" -gt 0 ] \
+            || { echo "::error::no module zips were fetched; this run proves nothing about coverage"; exit 1; }
+          [ "${other}" -eq 0 ] \
+            || { echo "::error::${other} request(s) went to a host other than Artifactory"; exit 1; }
 
       # The action exports GOFLAGS=-mod=readonly to GITHUB_ENV, which is
       # job-wide and cannot be scoped to one step. This repo commits vendor/,