From 04ee1ab26beccc0b95cf1b738ff4ad93af74c31c Mon Sep 17 00:00:00 2001
From: Rex Raphael <rex.raphael@outlook.com>
Date: Sat, 1 Aug 2026 18:03:17 -0500
Subject: [PATCH 1/2] ci: run Discovery Module Release on Go 1.25

discovery/etcd and discovery/mdns declare go 1.25.0, forced by their
golang.org/x/net, x/sys and x/text requirements, which came in with the
advisory fix in 0aa9069. actions/setup-go pins GOTOOLCHAIN=local, so the
job's Go 1.23 refused to build them:

    go: go.mod requires go >= 1.25.0 (running go 1.23.12; GOTOOLCHAIN=local)

The other four discovery modules stay at go 1.23.0 and build fine on a
1.25 toolchain, so the job now uses the highest directive across the set.
---
 .github/workflows/release.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 35933dc..4b02baa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -233,7 +233,10 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.23'
+          # discovery/etcd and discovery/mdns declare go 1.25.0, forced by
+          # golang.org/x/net, x/sys and x/text. setup-go pins GOTOOLCHAIN=local,
+          # so this must be >= the highest directive across the discovery modules.
+          go-version: '1.25'
 
       - name: Check if discovery module exists
         id: check_discovery

From 2a7a2620f789cfd500fd65c05c1037056462947b Mon Sep 17 00:00:00 2001
From: Rex Raphael <rex.raphael@outlook.com>
Date: Sat, 1 Aug 2026 18:07:20 -0500
Subject: [PATCH 2/2] ci: build discovery modules on every PR

The discovery modules are separate Go modules, so the root `go test ./...`
never reached them. Their first build was the post-merge release job, which
is how the go 1.25.0 directive bump in 0aa9069 reached main before anything
tried to compile it.

Modules are enumerated with find rather than hardcoded, so a new submodule
is covered automatically -- the release job's fixed list would skip it. The
loop visits every module before exiting non-zero, so one broken module does
not hide the rest.
---
 .github/workflows/ci.yml | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b87dbd..85c9ae8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -95,6 +95,41 @@ jobs:
         with:
           sarif_file: results.sarif
 
+  # The discovery modules are separate Go modules, so `go test ./...` at the
+  # repo root never reaches them. Without this job their first build is the
+  # post-merge release, where a failure has already landed on main.
+  discovery:
+    name: Discovery Modules
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          # discovery/etcd and discovery/mdns declare go 1.25.0. setup-go pins
+          # GOTOOLCHAIN=local, so this must be >= the highest directive across
+          # the discovery modules.
+          go-version: '1.25'
+          cache: true
+          cache-dependency-path: discovery/**/go.sum
+
+      - name: Vet and test every discovery module
+        run: |
+          set -uo pipefail
+          failed=0
+          while IFS= read -r modfile; do
+            dir=$(dirname "$modfile")
+            echo "=== $dir ==="
+            if ! ( cd "$dir" && go vet ./... && go test -race ./... ); then
+              echo "::error::discovery module $dir failed"
+              failed=1
+            fi
+          done < <(find discovery -name go.mod | sort)
+          exit $failed
+
   # Rust CI
   rust-test:
     name: Rust Tests