(hugegraph-toolchain) branch master updated: fix(ci): review Go dependency manifest changes (#820)

[ji...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

imbajin pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/hugegraph-toolchain.git


The following commit(s) were added to refs/heads/master by this push:
     new f58181af8 fix(ci): review Go dependency manifest changes (#820)
f58181af8 is described below

commit f58181af873cb3fb37028e4bfdbd78e0bd9b0719
Author: imbajin <ji...@apache.org>
AuthorDate: Thu Oct 15 03:39:11 2026 +0800

    fix(ci): review Go dependency manifest changes (#820)
    
    - select go.mod and go.sum as dependency inputs
    - route manifest PRs through existing dependency review
    - retain Go runtime scope and configured scan languages
    - document the selected dependency audit
---
 .github/scripts/ci-policy.py      |  2 +-
 .github/scripts/test_ci_policy.py | 11 +++++++++++
 docs/ci.md                        |  2 +-
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/scripts/ci-policy.py b/.github/scripts/ci-policy.py
index ad5b82626..9e4659706 100644
--- a/.github/scripts/ci-policy.py
+++ b/.github/scripts/ci-policy.py
@@ -540,7 +540,7 @@ def create_plan(project, event, repository, fetch=api, external_inputs=None, eve
 
 
 def dependency_input(path):
-    return bool(re.search(r"(^|/)(pom\.xml|package\.json|yarn\.lock|package-lock\.json)$|"
+    return bool(re.search(r"(^|/)(pom\.xml|package\.json|yarn\.lock|package-lock\.json|go\.mod|go\.sum)$|"
                           r"(^|/)(assembly|licenses)/|(^|/)(LICENSE|NOTICE)$|dependency/|"
                           r"^\.mvn/|^\.github/(configs/|workflows/(license-checker|dependency-license)\.yml)", path))
 
diff --git a/.github/scripts/test_ci_policy.py b/.github/scripts/test_ci_policy.py
index 180fc2558..e1ac61aaa 100644
--- a/.github/scripts/test_ci_policy.py
+++ b/.github/scripts/test_ci_policy.py
@@ -81,6 +81,17 @@ class PolicyTest(unittest.TestCase):
             self.assertTrue(policy.dependency_input(path))
         self.assertFalse(self.pr_plan(["docs/ci.md"])["dependency_audit"])
 
+    def test_go_manifests_select_dependency_review(self):
+        for path in ["hugegraph-client-go/go.mod", "hugegraph-client-go/go.sum"]:
+            with self.subTest(path=path):
+                plan = self.pr_plan([path])
+                self.assertTrue(plan["dependency_audit"])
+                self.assertIn("dependency-audit", plan["expected"])
+                self.assertEqual([path], plan["selectionReasons"]["dependency-audit"])
+                self.assertEqual(["go"], plan["selected"])
+                self.assertFalse(plan["security"])
+        self.assertFalse(self.pr_plan(["hugegraph-client-go/client.go"])["dependency_audit"])
+
     def test_failure_summary_is_written_before_advisory_failure(self):
         with tempfile.TemporaryDirectory() as directory:
             summary = Path(directory) / "summary.md"
diff --git a/docs/ci.md b/docs/ci.md
index 980e39206..88b63fcae 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -67,7 +67,7 @@ Selection uses the cumulative PR diff, so appending documentation to a source PR
 
 CodeQL keeps its existing analysis identity, configured languages and upload permissions. Its source/SDK build only runs for Java scans; dependency review belongs to the selected dependency audit. Current and legacy runtime checks compile Toolchain on Java 17 while the official Server 1.7 service uses its own Java 11 JVM.
 
-The dependency inventory audit includes root `.mvn/**`, POMs, dependency manifests, assembly/license inputs and staged Maven settings. It runs from the repository root with the same root Maven configuration, separately from the entry license checks.
+The dependency inventory audit includes root `.mvn/**`, POMs, dependency manifests (including Go `go.mod` and `go.sum`), assembly/license inputs and staged Maven settings. It runs from the repository root with the same root Maven configuration, separately from the entry license checks. On pull requests, the selected audit also runs dependency review.
 
 For rollout, confirm live branch protection has reconciled to an empty context list; required approving review count and stale-review dismissal remain configured. Until reconciliation, the real entry `check-license-header` still satisfies the previous rule. A new PR head cancels older first attempts; native reruns use separate groups and cannot cancel the current head.