fix(manifest-guard): retain Go binding declaration coverage

actions/manifest-ownership-scan/scan.sh

@@ -67,9 +67,10 @@ PATTERNS=(
   # catch it. A plain READ (`req.Revision == ""`) stays allowed: reading a
   # released contract field owns neither the type nor a binding. The explicit
   # spellings and refs/heads/ stay matched wherever they appear.
-  "Repository branch binding::(^|[^[:alnum:]_])(repoBranch|repositoryBranch|repository_branch|repository-branch|gitBranch|git_branch|git-branch)([^[:alnum:]_]|$)|refs/heads/|^[[:space:]]*(-[[:space:]]*)?[\"']?branch[\"']?[[:space:]]*(:|=[^=])|^[[:space:]]*branch[[:space:]]+[^[:space:]]|[\"']branch[\"'][[:space:]]*:|:[\"']branch[\"']|[.>]branch[[:space:]]*=[^=]|[{,][[:space:]]*branch[[:space:]]*:|(set|with)_?branch[[:space:]]*\\("
-  # Same rule as Branch above, including the allowed selector read.
-  "Repository revision binding::(^|[^[:alnum:]_])(targetRevision|repoRevision|repositoryRevision|repository_revision|repository-revision|gitRevision|git_revision|git-revision)([^[:alnum:]_]|$)|^[[:space:]]*(-[[:space:]]*)?[\"']?revision[\"']?[[:space:]]*(:|=[^=])|^[[:space:]]*revision[[:space:]]+[^[:space:]]|[\"']revision[\"'][[:space:]]*:|:[\"']revision[\"']|[.>]revision[[:space:]]*=[^=]|[{,][[:space:]]*revision[[:space:]]*:|(set|with)_?revision[[:space:]]*\\("
+  "Repository branch binding::(^|[^[:alnum:]_])(repoBranch|repositoryBranch|repository_branch|repository-branch|gitBranch|git_branch|git-branch)([^[:alnum:]_]|$)|refs/heads/|^[[:space:]]*(-[[:space:]]*)?[\"']?branch[\"']?[[:space:]]*(:|=[^=])|^[[:space:]]*branch[[:space:]]+[^[:space:]]|(^|[{;])[[:space:]]*(var|const)[[:space:]]+branch[[:space:]]+[^[:space:]]|^[[:space:]]*type[[:space:]]+[[:alnum:]_]+[[:space:]]+struct[[:space:]]*[{]([^}]*;)?[[:space:]]*branch[[:space:]]+[^[:space:]]|[\"']branch[\"'][[:space:]]*:|:[\"']branch[\"']|[.>]branch[[:space:]]*=[^=]|[{,][[:space:]]*branch[[:space:]]*:|(set|with)_?branch[[:space:]]*\\("
+  # Same rule as Branch above, including var/const and inline fields,
+  # while preserving the allowed selector read.
+  "Repository revision binding::(^|[^[:alnum:]_])(targetRevision|repoRevision|repositoryRevision|repository_revision|repository-revision|gitRevision|git_revision|git-revision)([^[:alnum:]_]|$)|^[[:space:]]*(-[[:space:]]*)?[\"']?revision[\"']?[[:space:]]*(:|=[^=])|^[[:space:]]*revision[[:space:]]+[^[:space:]]|(^|[{;])[[:space:]]*(var|const)[[:space:]]+revision[[:space:]]+[^[:space:]]|^[[:space:]]*type[[:space:]]+[[:alnum:]_]+[[:space:]]+struct[[:space:]]*[{]([^}]*;)?[[:space:]]*revision[[:space:]]+[^[:space:]]|[\"']revision[\"'][[:space:]]*:|:[\"']revision[\"']|[.>]revision[[:space:]]*=[^=]|[{,][[:space:]]*revision[[:space:]]*:|(set|with)_?revision[[:space:]]*\\("
   'Git library::github\.com/(go-git/go-git|libgit2/git2go|src-d/go-git)/|org\.eclipse\.jgit|git2::Repository|simple-git|isomorphic-git|nodegit|GitPython|dulwich'
   'GitHub API client::github\.com/google/go-github/|github\.com/shurcooL/githubv4|github\.NewClient|@octokit/|PyGithub|githubkit|octocrab'
   'Pull request operation::PullRequest|pull_request|pull-request|pulls\.(Create|Edit|List|Merge)'

actions/manifest-ownership-scan/scan_test.sh

@@ -134,6 +134,28 @@ else
   done
 fi
 
+# Go declarations are bindings even with var/const prefixes or inline fields.
+# Prose and contract reads above must remain clean under the same matcher.
+if out="$(SCAN_ROOT="$here/testdata/go-declarations" bash "$scan" 2>&1)"; then
+  fail "Go binding declarations should fail but passed"
+else
+  for expectation in \
+    "[Repository branch binding] source.go:4:" \
+    "[Repository revision binding] source.go:5:" \
+    "[Repository branch binding] source.go:9:" \
+    "[Repository revision binding] source.go:10:" \
+    "[Repository branch binding] source.go:13:" \
+    "[Repository revision binding] source.go:13:" \
+    "[Repository branch binding] source.go:14:" \
+    "[Repository revision binding] source.go:14:"; do
+    if grep -qF "$expectation" <<<"$out"; then
+      pass "Go declaration reported: $expectation"
+    else
+      fail "Go declaration missed: $expectation"$'\n'"$out"
+    fi
+  done
+fi
+
 # Excluded paths must not be the reason a dirty tree fails: prove the release
 # workflow's git@github.com and the fixture's argoproj.io are never reported
 # for the clean tree.

actions/manifest-ownership-scan/testdata/go-declarations/source.go

@@ -0,0 +1,14 @@
+package runtime
+
+func variables() {
+	var Branch = "main"
+	var Revision = "HEAD"
+	_, _ = Branch, Revision
+}
+func constants() {
+	const Branch = "main"
+	const Revision = "HEAD"
+	_, _ = Branch, Revision
+}
+type Inline struct { Branch string; Revision string }
+func inline() { var Branch = "main"; var Revision = "HEAD"; _, _ = Branch, Revision }

actions/manifest-ownership-scan/testdata/runtime-prose/runtime.go

@@ -13,3 +13,8 @@ func installsLinkedPackages(container bool) bool {
 	}
 	return true
 }
+
+// Select a path; branch selection depends on the input.
+// Update the plan; revision history remains available.
+// Explain the choice { branch selection depends on the input.
+// Explain the choice { revision history remains available.

docs/manifest-guard.md

@@ -19,6 +19,9 @@ The guard does two things:
    ownership concepts: Git operations and remotes, repository URL/branch/
    revision bindings, pull requests, GitHub clients, Argo/Flux clients and API
    groups, `Application`, `AppProject`, `repoURL`, and `targetRevision`.
+   Branch/revision binding includes Go `var`/`const` declarations and inline
+   struct fields; plain released-contract field reads and comment prose remain
+   allowed.
 
 Exclusions are **path-based only**. Repository automation (`.github/`,
 `.coderabbit.yaml`, and conventional publish/release script directories) and