ci: verify Artifactory serves bytes rather than redirecting

The download counters cannot see a redirect. `go mod download -x` traces
the URL Go requested, and http.Client.Do follows redirects inside that
call, logging the final status against the original URL. So a 3xx handing
the transfer to another origin would increment `served` and leave `other`
at zero while the bytes came from somewhere else. Raised in review of
#2376.

Two changes.

The GOPROXY assertion is now an exact match on the full expected URL
rather than a host prefix. The `-cdn` repository variants are the one
documented path where Artifactory hands a client to another origin
(Direct Download), so pinning the repo key closes it. Upstream F-009
records that Direct Download never engages for Go — no module archive
approaches its 100 MB threshold — but the assertion costs nothing and
does not depend on that remaining true.

And a canary: fetch one module archive with curl and assert zero
redirects and an Artifactory final URL. Redirect behavior is a
repository-level setting rather than per-module, so one request is
representative; if the repo were configured to redirect, it would
redirect every zip rather than one.

The credential is passed through `curl --config` on stdin so the token
never reaches argv, where a process listing on the runner would expose
it. That mirrors why the action writes a GOAUTH helper instead of an
environment variable.

Not adopting the suggested outbound-host allowlist: enforcing egress at
the network layer on a GitHub-hosted runner is disproportionate for a
workflow that verifies a property and ships nothing.

Signed-off-by: Mark Chmarny <mark@chmarny.com>

Author: mchmarny

.github/workflows/dgxc-goproxy-probe.yaml

@@ -128,10 +128,15 @@ jobs:
           case "${proxy}" in
             *"|"*) echo "GOPROXY uses '|', which falls through on 401/403. Use ','."; exit 1 ;;
           esac
-          case "${proxy%%,*}" in
-            https://edge.urm.nvidia.com/*) ;;
-            *) echo "first GOPROXY entry is '${proxy%%,*}', not Artifactory"; exit 1 ;;
-          esac
+          # Exact match, not a host prefix. The `-cdn` repository variants are
+          # the one documented path on which Artifactory hands a client off to
+          # another origin (Direct Download), so pinning the repo key and not
+          # just the host closes it. Upstream F-009 records that Direct
+          # Download never engages for Go anyway — no module archive
+          # approaches its 100 MB threshold — but the assertion costs nothing.
+          expected="https://edge.urm.nvidia.com/artifactory/api/go/dgxc-go-virtual"
+          [ "${proxy}" = "${expected}" ] \
+            || { echo "GOPROXY is '${proxy}', expected exactly '${expected}'"; exit 1; }
           [ "$(go env GOSUMDB)" != off ] || { echo "GOSUMDB=off"; exit 1; }
           # Enforced means no fallback at all. Reject any comma rather than
           # just `,direct`: Go consults later entries on 404/410 whatever they
@@ -142,6 +147,39 @@ jobs:
           esac
           echo "OK: Artifactory is the only GOPROXY entry and GOSUMDB is intact"
 
+      # `go mod download -x` traces the URL Go *requested*, and http.Client.Do
+      # follows redirects inside that call, logging the final status against
+      # the original URL. So the download counters below cannot see a 3xx that
+      # hands the transfer to another origin: `served` would increment and
+      # `other` stay zero while the bytes came from elsewhere.
+      #
+      # Redirect behavior is a repository-level setting rather than per-module,
+      # so one request is a representative canary. The credential comes from
+      # the GOAUTH helper via curl --config so the token never reaches argv,
+      # where a process listing would expose it.
+      - name: Assert Artifactory serves bytes rather than redirecting
+        shell: bash
+        run: |
+          url="https://edge.urm.nvidia.com/artifactory/api/go/dgxc-go-virtual/gopkg.in/yaml.v2/@v/v2.4.0.zip"
+          auth="$("${GOAUTH}" | grep -i '^Authorization:')"
+          [ -n "${auth}" ] || { echo "::error::GOAUTH helper produced no Authorization header"; exit 1; }
+
+          read -r redirects effective < <(
+            printf 'header = "%s"\nurl = "%s"\n' "${auth}" "${url}" \
+              | curl --config - -sSL --max-time 60 -o /dev/null \
+                     -w '%{num_redirects} %{url_effective}'
+          )
+          echo "redirects: ${redirects}"
+          echo "final URL host: $(printf '%s' "${effective}" | sed -E 's#^https?://([^/]+)/.*#\1#')"
+
+          [ "${redirects}" -eq 0 ] \
+            || { echo "::error::Artifactory redirected ${redirects} time(s) to ${effective}"; exit 1; }
+          case "${effective}" in
+            https://edge.urm.nvidia.com/*) ;;
+            *) echo "::error::bytes came from ${effective}, not Artifactory"; exit 1 ;;
+          esac
+          echo "OK: Artifactory served the archive directly, no redirect to another origin"
+
       # Guards the guard. Both assertions above are satisfied by a job that
       # never fetches anything, which is how the first enforced run passed on a
       # restored module cache. Coverage is only demonstrated if modules were