ci: fix the security scan, which has failed on every push

Two unrelated causes, plus one that hid the others.

govulncheck: setup-go used go-version-file, so it installed exactly what
each go.mod pins -- `go 1.25.0` -- and then reported 28 CVEs in that
release's standard library (crypto/x509 quadratic name-constraint
parsing, GO-2025-4007, and friends), all fixed in 1.25.3. None of it
described anything we ship: every Dockerfile builds FROM
golang:1.25-alpine, a floating tag that resolves to the newest 1.25.x,
so the binaries already had the fixes. The go directive is a minimum
language version, not a statement about which toolchain to audit with.
Track the floating 1.25 line instead, and the scan matches production.
Confirmed by running govulncheck against a patched toolchain locally:
deploy/operator reports 0 vulnerabilities and exits 0.

cargo-deny: RUSTSEC-2024-0384, `instant` is unmaintained. A maintenance
advisory rather than a vulnerability -- no CVE, nothing to patch -- and
it arrives transitively via tantivy 0.22.1 -> measure_time 0.8.3, so it
cannot be dropped without moving off the pinned Tantivy. The advisory's
substance does not apply here anyway: instant papers over
std::time::Instant being missing on wasm, and search builds native musl.
Ignored in search/deny.toml with that reasoning recorded and a note to
delete the entry at the next Tantivy upgrade rather than let it ossify.

Both matrices now set fail-fast: false. Only two of the twelve jobs
actually failed; the other nine were cancelled, which made a two-cause
failure look like a total collapse and hid every finding but the first.

.github/workflows/security-scan.yml

@@ -21,6 +21,7 @@ jobs:
     name: Rust vulnerability check (cargo-deny)
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         crate_dir: [agent, search]
     steps:
@@ -34,6 +35,9 @@ jobs:
     name: Go vulnerability check (govulncheck)
     runs-on: ubuntu-latest
     strategy:
+      # One module's findings must not cancel the other eight -- with
+      # fail-fast a single failure hid the whole matrix behind one log.
+      fail-fast: false
       matrix:
         # Same module list as license-compliance.yml's go-licenses job --
         # see that job's own comment for why cli/hack-webhook-sink/
@@ -53,7 +57,18 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version-file: ${{ matrix.module_dir }}/go.mod
+          # Deliberately NOT go-version-file. Each go.mod pins an exact
+          # patch (`go 1.25.0`), so go-version-file made CI scan against
+          # the *unpatched* 1.25.0 standard library and fail on 28
+          # stdlib CVEs -- crypto/x509 quadratic name-constraint parsing
+          # (GO-2025-4007) and friends, all fixed in 1.25.3. None of it
+          # was real: every Dockerfile builds `FROM golang:1.25-alpine`,
+          # a floating tag that resolves to the newest 1.25.x, so the
+          # shipped binaries already had the fixes. The go directive
+          # states the minimum language version, not the toolchain to
+          # audit with. Track the floating 1.25 line so this scans what
+          # production actually builds.
+          go-version: '1.25'
       - run: go install golang.org/x/vuln/cmd/govulncheck@latest
       - name: Check for known vulnerabilities
         working-directory: ${{ matrix.module_dir }}

search/deny.toml

@@ -70,6 +70,23 @@ feature-depth = 1
 # A list of advisory IDs to ignore. Note that ignored advisories will still
 # output a note when they are encountered.
 ignore = [
+    { id = "RUSTSEC-2024-0384", reason = """
+`instant` is unmaintained -- a maintenance advisory, not a vulnerability:
+no CVE, no known exploit, nothing to patch.
+
+It reaches us only transitively (tantivy 0.22.1 -> measure_time 0.8.3 ->
+instant 0.1.13), so it cannot be dropped without moving off the pinned
+Tantivy version, and CLAUDE.md pins the stack deliberately.
+
+The advisory's substance does not apply to this build either: `instant`
+exists to paper over std::time::Instant being unavailable on wasm, and
+the recommended replacement (web-time) addresses that same wasm gap.
+search builds for native musl, where instant is a thin pass-through to
+std.
+
+Revisit when Tantivy is next upgraded -- check whether measure_time has
+dropped the dependency, and delete this entry if so rather than letting
+it become permanent.""" },
     #"RUSTSEC-0000-0000",
     #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" },
     #"[email protected]", # you can also ignore yanked crate versions if you wish