[IAmJSD]

Root cause

Go's ./... pattern skips only testdata and paths that start with . or _. Once npm ci has run, frontend/node_modules/flatted/golang/pkg/flatted (Go source shipped inside an npm package, with no go.mod of its own) becomes a package of this module. Every Makefile Go target that passes ./... then checks that third-party code: vet, test-unit, test-compile-integration, test-integration, test-coverage and fmt. So do plain golangci-lint run and govulncheck ./.... #1286 already fixed the gocyclo walk and #1512 fixed the pre-commit go vet/go test hooks. The Makefile targets were the last item in the issue.

Fix

Add ignore ./frontend/node_modules to go.mod. The ignore directive arrived in Go 1.25, and this repo pins 1.26.10. It applies to ./... in every go command and to every tool that loads packages through go list/go/packages. As a result:

• The Makefile recipes don't change and still match the commands people copy and paste.
• Any future ./... target is covered automatically.

I chose this over the go list -e ./... | grep -v /node_modules/ fallback because the brief asked for it if every pinned tool accepts it, and they do (results below). The fallback would also have needed six recipe edits plus a pipefail guard per target.

A new case in scripts/test-make-gates.sh covers the regression. CI's lint job already runs that script ("Run Makefile gate self-tests"), and the step comment in ci.yml now mentions the new case. The case uses go list -overlay to add two packages:

• A probe package under frontend/node_modules/.
• A control package elsewhere under frontend/.

It then asserts that go list ./... and go list -tags=integration ./... list the control but not the probe. The control proves the overlay took effect, so the check can't pass vacuously, and it also shows the ignore covers only node_modules. No npm install is needed (the lint job has none) and nothing is written into the repo.

Closes #177

Verification

Local evidence: a real frontend/node_modules from cd frontend && npm ci, plus the overlay probe. Go 1.26.10.

Fail-before/pass-after of the new gate case (bash scripts/test-make-gates.sh):

# before (go.mod without the ignore line), even with frontend/node_modules removed:
FAIL: go list ./... walks into frontend/node_modules
    .../frontend/node_modules/zz-make-gates-probe
FAIL: go list ./... -tags=integration walks into frontend/node_modules
Results: 30 passed, 2 failed          (exit 1)
# after:
PASS: go list ./... lists the control probe under frontend/
PASS: go list ./... skips frontend/node_modules
PASS: go list ./... -tags=integration lists the control probe under frontend/
PASS: go list ./... -tags=integration skips frontend/node_modules
Results: 32 passed, 0 failed          (exit 0)

The commands each Makefile target runs, with frontend/node_modules populated (count of node_modules lines in -n output, before -> after):

target	command	before	after
vet	go vet -n ./...	5	0
test-compile-integration	go vet -n -tags=integration ./...	5	0
test-unit	go test -n -short ./...	8	0
test-integration / test-coverage	go test -n -tags=integration ./...	8	0
fmt	go fmt -n ./...	1	0
(build)	go build -n ./...	2	0

go list -e ./... went from 51 packages including .../frontend/node_modules/flatted/golang/pkg/flatted to 50 packages without it.

Pinned tools against the new go.mod:

• golangci-lint v2.10.1 (run --allow-parallel-runners --no-config --default=none --enable gocyclo ./...): before, it reported frontend/node_modules/flatted/golang/pkg/flatted/flatted.go:16:1: cyclomatic complexity 32 of func Stringify (exit 1). After, 0 issues. (exit 0). It parses the ignore directive without error.
• govulncheck v1.1.4 (-show verbose ./..., the CI pin): before, the flatted package was in the scanned package list. After, it isn't. Exit 0 both times, and the findings are unchanged.
• gocyclo v0.6.0: walks the filesystem and never reads go.mod, so the directive has no effect on it. The Makefile complexity target and ci.yml keep their existing -ignore '(^|/)(node_modules|vendor)/' from ci: keep gocyclo's filesystem walk out of node_modules and vendor #1286. Output is unchanged: 0 findings.
• Go toolchain: go build ./..., go vet ./... and go vet -tags integration ./... all pass. make tidy-check (go mod tidy -diff in both modules under GOTOOLCHAIN=go1.26.10 GOWORK=off) is clean, so tidy keeps the directive and its comment where they are. GOWORK=off go list ./... also skips the package.
• shellcheck scripts/test-make-gates.sh and actionlint .github/workflows/ci.yml are clean.

Combined-tree verification. This branch was tested together with the other queued branches on a local, never-pushed tree: queue/platform @ 400d256b = origin/main 7b86e386 plus these heads, merged in this order:

Branch	Tested head
fix/issue-243-rest	007c163
fix/issue-1206	312072f
fix/issue-111-email	6d422e2
fix/issue-111-fail-closed	3817e29
fix/issue-712-age-cap	a91120b
fix/issue-712-fargate	aeaf0d4
fix/issue-613-legacy-ids	350e837
fix/issue-120-guards	6f38ebc
fix/issue-120-shared-predicate	cb25735
fix/issue-151-account-update-keep	d20cf01
fix/issue-713-upcoming-filter	e73fdfb
fix/issue-263-bastion-opts	7861f32
fix/issue-43-fixture-ids	8cee203
fix/issue-177-makefile-walk	365a9d6
fix/issue-27-seller-not-registered	d845f66
fix/issue-313-user-columns	6d759dd
fix/issue-353-mock-panics	aac2edf
fix/issue-8-config-stamps	b548ae5
fix/issue-30-monthly-totals	f637921

Linux, Go 1.26.9, AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null AWS_EC2_METADATA_DISABLED=true; Docker Postgres via testcontainers. The full suite ran on f7c48020, which differs from this tree only by test-only commits on fix/issue-30, fix/issue-713 and fix/issue-263 that replace placeholder account-number literals with named constants:

• Passed: go build ./..., go vet ./..., go vet -tags integration ./... and the full go test -race -short -count=1 ./....
• Static checks: golangci-lint v2.10.1 found 0 issues on every changed package, with and without --build-tags integration. gocyclo -over 10 is silent on the changed non-test files.
• Integration tests, every changed package that has them, one package at a time (-tags integration -count=1): internal/analytics, internal/api, internal/auth, internal/config, internal/database/postgres/migrations, internal/purchase, internal/scheduler and internal/server all pass. Migrations 000149, 000150 and 000151 apply in order on this tree.
• Frontend: the changed jest files (approval-details, settings-accounts, api) pass (221 tests).
• Secrets: the first run flagged 9 new fixture lines (placeholder account numbers next to an account key); fixed with named constants. Re-run on this tree: git-secrets, using the repo's scripts/setup-git-secrets.sh patterns in a fresh repo with an isolated HOME, found nothing in the changed files, and a planted fake key was flagged. scripts/test-git-secrets-allowlist.sh: 183 PASS, 0 FAIL.
• Terraform .tftest.hcl files were not run locally (CI runs them). Nothing was applied to any cloud.

Left out of scope / notes

• gosec does not honor the directive. It walks directories itself, and scripts/run-gosec.sh passes only -exclude-dir=.legacy -exclude-dir=.dev-notes -exclude-dir=vendor. With deps installed, gosec v2.28.0 still checks frontend/node_modules/flatted/golang/pkg/flatted/flatted.go both before and after this PR. That is the same kind of exposure but a different tool, and chore(ci): gocyclo's filesystem walk in ci.yml scans frontend/node_modules when deps are installed #177 doesn't mention it. A one-line follow-up would add -exclude-dir=node_modules in run-gosec.sh.
• The pre-commit go-vet and go-test hooks keep their go list -e ./... | grep -v /node_modules/ filter from chore(ci): keep the pre-commit go vet and go test hooks out of node_modules #1512. It's now redundant but harmless, so I left it alone.
• I couldn't test Dependabot's parsing of go.mod locally. It needs a Go 1.25+ updater to accept ignore. Current Dependabot images ship a newer Go, so the first Dependabot gomod run after merge is worth a glance.

Maintainer: please mirror the issue's triage labels onto this PR: effort/xs, impact/internal, priority/p3, severity/low, triaged, type/chore, urgency/eventually.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: main
• File: .coderabbit.yaml
• Commit: 7b86e38
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 906bafb7-a807-416c-914f-dbd64ee21dfc

Commits

Reviewing files that changed from the base of the PR and between 7b86e38 and 00e7057.

Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

Files selected for processing: 3

• .github/workflows/ci.yml
• go.mod
• scripts/test-make-gates.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 00e7057bdf17151f5c63f35cdd73ac226a098b3e

Head moved from 365a9d69 to 00e7057b during review. The only new commit bumps golang.org/x/net to v0.62.0, the same change as #1564. I re-checked at the new head; the verdict is unchanged.

Blocking:

• none

Non-blocking:

• scripts/test-make-gates.sh: the header still says "Tools are stubs on a PATH that holds nothing else, so the real tools are never run", but case 5 now runs the real go list. That's harmless: the lint job runs actions/setup-go first, and go list -overlay writes nothing. One sentence in the header would fix it.
• This PR and fix(deps): bump golang.org/x/net to v0.62.0 (GO-2026-6860, GO-2026-6866) #1564 (and the other queued branches) carry the same x/net bump. Whichever merges second gets an identical-hunk merge, which is harmless.

Attacked:

• The ignore directive needs Go 1.25 or later. go.mod pins 1.26.10, and both Dockerfiles use golang:1.26.10. The ./frontend/node_modules form is rooted at the module root, so it doesn't hide the control package. The lint job sets up Go before "Run Makefile gate self-tests". Issue chore(ci): gocyclo's filesystem walk in ci.yml scans frontend/node_modules when deps are installed #177's remaining item, the Makefile ./... targets, is what this fixes, and the earlier gocyclo and pre-commit parts were done in ci: keep gocyclo's filesystem walk out of node_modules and vendor #1286 and chore(ci): keep the pre-commit go vet and go test hooks out of node_modules #1512, so Closes is justified.
• Ran go build ./..., go vet with and without -tags integration (at the original head) and bash scripts/test-make-gates.sh at both heads: 32 passed, 0 failed.
• Fail-before: with the ignore line removed from go.mod, the script reports FAIL: go list ./... walks into frontend/node_modules for both tag sets (30 passed, 2 failed). Restored.

Body-stale:

• none

_{Reviewer: rG2. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Local verification at 00e7057bdf17151f5c63f35cdd73ac226a098b3e merged onto main (d05a1726), together with #1547, #1555, #1558, #1559, #1561, #1562 in that order (combined tree eea0132d, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 1 approving independent review(s) on it. Nothing was run against any cloud.

[IAmJSD]

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 1 approving independent review(s) on 00e7057b, green CI, and the combined-tree verification above. Squash-merged at exactly 00e7057bdf17151f5c63f35cdd73ac226a098b3e.