fix(manifest-guard): classify generated Go checksums as metadata

actions/manifest-ownership-scan/scan.sh

@@ -118,7 +118,9 @@ EOF
 
 is_scannable() {
   case "$1" in
-    *.md.tmpl)
+    # Like plain go.sum (not a source extension below), a generated checksum
+    # lock records dependency bytes, not runtime imports or ownership.
+    go.sum.tmpl | */go.sum.tmpl | *.md.tmpl)
       return 1
       ;;
     *.go | *.rs | *.py | *.rb | *.java | *.kt | *.kts | *.swift | *.c | *.cc | *.cpp | *.h | *.hpp | \

actions/manifest-ownership-scan/scan_test.sh

@@ -46,6 +46,26 @@ else
   done
 fi
 
+# Checksums can describe transitive test dependencies, without importing them
+# in the generated runtime. The generated source and module declarations still
+# carry ownership evidence and must remain visible beside those checksums.
+if out="$(SCAN_ROOT="$here/testdata/checksum-metadata" bash "$scan" 2>&1)"; then
+  pass "generated Go dependency checksums are metadata"
+else
+  fail "checksum metadata should pass but failed:"$'\n'"$out"
+fi
+if out="$(SCAN_ROOT="$here/testdata/generated-client" bash "$scan" 2>&1)"; then
+  fail "generated GitHub client source and declaration should fail"
+else
+  for file in main.go.tmpl go.mod.tmpl; do
+    if grep -qF "[GitHub API client] templates/factory/code/$file:" <<<"$out"; then
+      pass "generated client remains detected in $file"
+    else
+      fail "generated client missed in $file:"$'\n'"$out"
+    fi
+  done
+fi
+
 # Canonical Go identifiers must be detected without relying on a YAML copy of
 # the same concept elsewhere in the tree.
 if out="$(SCAN_ROOT="$here/testdata/runtime-identifiers" bash "$scan" 2>&1)"; then

actions/manifest-ownership-scan/testdata/checksum-metadata/templates/factory/code/go.sum.tmpl

@@ -0,0 +1,2 @@
+github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0=
+github.com/google/go-github/v89 v89.0.0/go.mod h1:QLcbU0ipeAqQuR5KSg8c2lql4Qk1EwJ2dWz/0rP4Nho=

actions/manifest-ownership-scan/testdata/generated-client/templates/factory/code/go.mod.tmpl

@@ -0,0 +1,2 @@
+module generated
+require github.com/google/go-github/v89 v89.0.0

actions/manifest-ownership-scan/testdata/generated-client/templates/factory/code/go.sum.tmpl

@@ -0,0 +1,2 @@
+github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0=
+github.com/google/go-github/v89 v89.0.0/go.mod h1:QLcbU0ipeAqQuR5KSg8c2lql4Qk1EwJ2dWz/0rP4Nho=

actions/manifest-ownership-scan/testdata/generated-client/templates/factory/code/main.go.tmpl

@@ -0,0 +1,2 @@
+package main
+import "github.com/google/go-github/v89/github"

docs/manifest-guard.md

@@ -25,6 +25,10 @@ Exclusions are **path-based only**. Repository automation (`.github/`,
 test fixtures (`*_test.*`, `testdata/`, `fixtures/`, and conventional test
 paths) are excluded by default. Additional exclusions are accepted only for
 those same automation and fixture path shapes; runtime paths are rejected.
+Go checksum locks (`go.sum` and `go.sum.tmpl`) are metadata, not source: transitive
+or test dependency checksums do not establish runtime ownership. Generated Go
+source and dependency declarations remain scanned; a forbidden import in
+`main.go.tmpl` or a dependency in `go.mod.tmpl` still fails.
 
 ## Adopt it (Kubernetes-output plugin)