Exclude build proxy artifacts from native provider module archives

Authored-By: Codex (GPT-6) <noreply@openai.com>

tools/private-modules/main.go

@@ -21,6 +21,7 @@ import (
 
 const bundleRoot = "third_party/go-proxy"
 const privatePrefix = "code.fritzlab.net/"
+const archiveBoundary = "module code.fritzlab.net/action/image-build/private-module-artifacts\n\ngo 1.27.0\n"
 
 type artifact struct {
 	Path   string `json:"path"`
@@ -79,6 +80,9 @@ func generate() error {
 		return err
 	}
 	defer os.RemoveAll(temp)
+	if err := os.WriteFile(filepath.Join(temp, "go.mod"), []byte(archiveBoundary), 0444); err != nil {
+		return err
+	}
 	decoder := json.NewDecoder(bytes.NewReader(raw))
 	var total int64
 	for {
@@ -226,7 +230,11 @@ func check() error {
 	if mod != m.GoModSHA256 || sum != m.GoSumSHA256 {
 		return errors.New("private module closure stale; regenerate after go.mod/go.sum changes")
 	}
-	expected := map[string]bool{"manifest.json": true}
+	boundary, err := os.ReadFile(filepath.Join(bundleRoot, "go.mod"))
+	if err != nil || string(boundary) != archiveBoundary {
+		return errors.New("private module archive boundary missing or modified")
+	}
+	expected := map[string]bool{"manifest.json": true, "go.mod": true}
 	last := ""
 	var total int64
 	for _, m := range m.Modules {

tools/private-modules/main_test.go

@@ -27,9 +27,17 @@ func TestBundleRejectsStaleMissingModifiedAndUnexpectedArtifacts(t *testing.T) {
 	}
 	b, _ := json.Marshal(m)
 	os.WriteFile(filepath.Join(bundleRoot, "manifest.json"), b, 0600)
+	os.WriteFile(filepath.Join(bundleRoot, "go.mod"), []byte(archiveBoundary), 0600)
 	if err := check(); err != nil {
 		t.Fatal(err)
 	}
+	for _, boundary := range []string{"", "module unexpected.invalid/nested\n"} {
+		os.WriteFile(filepath.Join(bundleRoot, "go.mod"), []byte(boundary), 0600)
+		if check() == nil {
+			t.Fatal("missing or changed archive boundary accepted")
+		}
+	}
+	os.WriteFile(filepath.Join(bundleRoot, "go.mod"), []byte(archiveBoundary), 0600)
 	originalPath, originalVersion := m.Modules[0].Path, m.Modules[0].Version
 	for _, change := range []string{"path", "version"} {
 		if change == "path" {