Repository Coverage
This generated matrix declares the complete GoForj security assurance scope reviewed on September 8, 2026. Change the authoritative .vitepress/data/security-coverage.json manifest, then run npm run security:refresh to update this page.
Reading the matrix
A baseline is active only when its configuration is present on the repository default branch. Follow the Evidence link to inspect current runs and artifacts.
Control Profiles
| Profile | Controls |
|---|---|
| Go source | CodeQL, govulncheck, Dependency Review, full-history Gitleaks, CycloneDX SBOMs, Dependabot, and immutable actions |
| Go and npm application | Go source baseline plus npm audit, npm SBOM coverage, and npm dependency updates |
| Framework and generated assets | Go and npm application baseline plus generated asset inventory and container policy checks |
Included Repositories
| Repository | Role | Baseline | Evidence |
|---|---|---|---|
| goforj | Framework, generator, and application templates | Framework and generated assets | Actions, Dependabot, Code scanning |
| docs | Documentation frontend and Go backend | Go and npm application | Actions, Dependabot, Code scanning |
| atlas | Documentation indexing and generation | Go source | Actions, Dependabot, Code scanning |
| cache | Cache contracts and drivers | Go source | Actions, Dependabot, Code scanning |
| collection | Collection helpers | Go source | Actions, Dependabot, Code scanning |
| console | Console output | Go source | Actions, Dependabot, Code scanning |
| crypt | Encryption helpers | Go source | Actions, Dependabot, Code scanning |
| env | Environment loading | Go source | Actions, Dependabot, Code scanning |
| events | Event contracts and drivers | Go source | Actions, Dependabot, Code scanning |
| execx | Process execution | Go source | Actions, Dependabot, Code scanning |
| godump | Debug value inspection | Go source | Actions, Dependabot, Code scanning |
| httpx | Outbound HTTP requests | Go source | Actions, Dependabot, Code scanning |
| Mail contracts and drivers | Go source | Actions, Dependabot, Code scanning | |
| metrics | Metrics contracts | Go source | Actions, Dependabot, Code scanning |
| null | Nullable value types | Go source | Actions, Dependabot, Code scanning |
| queue | Queue contracts and drivers | Go source | Actions, Dependabot, Code scanning |
| scheduler | Scheduled task execution | Go source | Actions, Dependabot, Code scanning |
| storage | Storage contracts and drivers | Go source | Actions, Dependabot, Code scanning |
| str | String helpers | Go source | Actions, Dependabot, Code scanning |
| web | HTTP contracts, middleware, and adapters | Go source | Actions, Dependabot, Code scanning |
| wire | Compile-time dependency injection | Go source | Actions, Dependabot, Code scanning |
Coverage Maintenance
The generator rejects missing, duplicate, or unknown repositories. Repository workflows independently discover manifests so module-level coverage does not depend on this documentation list.
When the ecosystem scope changes, update the manifest, the generator's expected repository set, and the relevant repository controls in the same reviewed change.