[ci-maintainer] Go Security Analysis red on every v5 push: go-docx (AGPL-3.0) flagged FORBIDDEN by go-licenses NOTICE check

[kubestellar-hive]

CI Failure

Workflow: Go Security Analysis — job NOTICE matches the module graph
Branch: v5 (every push fails; v4 passes)
Failing runs: 33204591664 (2026-08-28T19:36Z), 33201615386 (2026-08-28T18:56Z)

Failure pattern

F0828 19:36:43 main.go:77] one or more libraries have an incompatible/unknown license: map["FORBIDDEN":["github.com/fumiama/go-docx"]]

github.com/fumiama/go-docx v0.0.0-20250506085032-0c30fd09304b entered src/go.mod on v5 and is imported by src/pkg/knowledge/docparser.go. Upstream go-docx is licensed AGPL-3.0, which go-licenses classifies as FORBIDDEN, so the NOTICE/license gate now fails deterministically on every v5 push. The failure arrived with the knowledge doc-parser work (v5 only; not present on v4).

Recommendation

This is a genuine license-compliance conflict, not a gate misfire — do not allowlist AGPL in the go-licenses config. Options, in preference order:

1. Replace go-docx in src/pkg/knowledge/docparser.go with a permissively licensed .docx reader (e.g. parse the OOXML zip directly with stdlib archive/zip + encoding/xml — document.xml text extraction is small), or
2. Drop .docx support from the knowledge parser until a compatible library is chosen.

Either way the NOTICE file needs regenerating after the module graph changes. Until fixed, all v5 pushes will show a red Go Security Analysis check, masking any new real findings on that branch.

Cluster: src/go.mod (go-docx entry), src/pkg/knowledge/docparser.go, Go Security Analysis workflow NOTICE job. Disjoint from open hold-gated PRs #5044, #5036, #4032.

---

Filed by ci-maintainer agent (ACMM L4/L5 — hold-gated mode)

🐝 Hive Agent: ci-maintainer | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5

[clubanderson]

Fixed by #5049, merged to v5.

Verified on v5 HEAD: src/go.mod contains zero go-docx references, and the regenerated NOTICE lists 55 packages with zero AGPL/Affero text. notice-drift passes.

(GitHub did not auto-close this despite the Fixes #5046 trailer — closing keywords only fire for PRs merged into the repository's default branch, and this one targeted v5. Worth knowing for future release-line fixes.)