ci: enforce the DGXC Go proxy, closing the fallthrough gap

Drops the `,direct` fallback so a module Artifactory does not serve is a
hard failure rather than a silent fetch from the public internet.

This also makes the workflow its own coverage measurement, which is why no
separate reporting step is added. Under `routed` a green run proved only
that nothing was rejected: a 404 fell through and the build still passed,
so coverage was unknown. With the fallback gone, a green run means every
module in the resolved graph came from Artifactory, because there is
nowhere else it could have come from. A gap does not need to be reported —
it fails the build and names the module.

The graph resolved here is the real one: `go mod download` plus
`go mod vendor` cover the build and test dependencies, which is the same
set a non-vendored build would need.

Enforced here first because nothing depends on this workflow — it verifies
a property, it does not build or ship. If some module turns out not to be
served, the blast radius is one red check on main. That safety margin
exists only while the repo still vendors, which is why #2375 is sequenced
ahead of #2374 rather than after it.

Adds an assertion that GOPROXY carries no `,direct` entry. Without it a
regression to `routed` would satisfy every existing assertion while
quietly restoring the path this change closes.

Closes #2375

Signed-off-by: Mark Chmarny <mark@chmarny.com>

Author: mchmarny

.github/workflows/dgxc-goproxy-probe.yaml

@@ -25,12 +25,20 @@
 # `refs/pull/N/merge` instead and cannot validate the identity mapping the
 # exchange actually matches on.
 #
-# What a green run proves: the OIDC exchange mints a token, GOPROXY is ordered
-# with Artifactory first, GOSUMDB verification is intact, and a real module graph
-# resolves. What it does NOT prove: coverage. Under `routed` the resolver falls
-# through to `direct` on 404/410, so a module Artifactory does not carry is
-# fetched from the public internet and the build still goes green. Only
-# `enforced` closes that, and only once the graph is known to be served.
+# Runs in `enforced` mode: GOPROXY carries no `,direct` fallback, so a module
+# Artifactory does not serve is a hard failure rather than a silent fetch from
+# the public internet.
+#
+# That also makes this workflow its own coverage measurement. Under `routed` a
+# green run proved only that nothing was *rejected*; a 404 fell through and the
+# build still passed, so coverage was unknown. With the fallback gone, a green
+# run means every module in the resolved graph came from Artifactory — there is
+# nowhere else it could have come from. No separate reporting step is needed:
+# the failure mode names the unserved module directly.
+#
+# Safe to enforce here first because nothing depends on this workflow. It
+# verifies a property; it does not build or ship anything. If Artifactory turns
+# out not to serve some module, the blast radius is one red check on main.
 name: DGXC Go Proxy Probe
 
 on:
@@ -94,7 +102,7 @@ jobs:
       - name: Configure the DGXC Go proxy
         uses: ./.github/actions/setup-dgxc-goproxy
         with:
-          mode: routed
+          mode: enforced
 
       # Non-optional. GOPROXY is an ordered list and Go consults later entries
       # only on 404/410, so `proxy.golang.org,<artifactory>,direct` looks routed,
@@ -114,7 +122,13 @@ jobs:
             *) echo "first GOPROXY entry is '${proxy%%,*}', not Artifactory"; exit 1 ;;
           esac
           [ "$(go env GOSUMDB)" != off ] || { echo "GOSUMDB=off"; exit 1; }
-          echo "OK: Artifactory is first in GOPROXY and GOSUMDB is intact"
+          # Enforced means no fallback at all. Without this, a regression to
+          # `routed` would still satisfy every assertion above while quietly
+          # restoring the public-internet path this workflow exists to close.
+          case "${proxy}" in
+            *,direct|*,direct,*) echo "GOPROXY still carries a ',direct' fallback; this is not enforced"; exit 1 ;;
+          esac
+          echo "OK: Artifactory is the only GOPROXY entry and GOSUMDB is intact"
 
       # The real work. `go mod download` resolves from go.mod/go.sum rather
       # than reading vendor/, so it is a genuine application-dependency fetch