refactor: rename Go module to unlocked-core (EN-187)

[carddev81]

Pre-Submission PR Checklist

• No debug/console/fmt.Println statements
• Unnecessary development comments removed
• All acceptance criteria verified (contracts commit still to come)
• Functions according to ticket specifications
• Tested manually where applicable
• Branch rebased with latest main
• No business logic exists within the database layer

Heads up: update Go to 1.26.9

This PR requires Go 1.26.9 (was 1.26.6) to fix GO-2026-6617. Once it merges, VS Code and gopls show go.work requires go >= 1.26.9 until you update. The terminal downloads it automatically, but VS Code doesn't.

To update (Linux, Go in /usr/local/go):

cd /tmp
curl -LO https://go.dev/dl/go1.26.9.linux-amd64.tar.gz
echo "42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d  go1.26.9.linux-amd64.tar.gz" | sha256sum -c
sudo mv /usr/local/go /usr/local/go1.26.6
sudo tar -C /usr/local -xzf go1.26.9.linux-amd64.tar.gz
go version   # go1.26.9

Then in VS Code: Go: Install/Update Tools → Developer: Reload Window. On a Mac, use the installer from https://go.dev/dl/.

Description of the change

Renames the Go module so other repos can import core (EN-187), and fixes a Go vulnerability the scan flagged.

• backend/go.mod: UnlockEdv2 → github.com/UnlockedLabs/unlocked-core/backend, with all imports updated (mechanical, no logic changes).

• provider-middleware, migrations and seeder now require + replace => ../backend, so they build without go.work.

• New CI step builds every module with GOWORK=off.

• CI repo checks, merge.sh and doc links point at unlocked-core.

• GO-2026-6617: Go 1.26.6 → 1.26.9 (go.mod files, go.work, CI, provider-middleware Dockerfile) and golang.org/x/net v0.57.0 → v0.60.0.

• Related issues: EN-187

Additional context

• Draft: still to come, a commit that points backend and provider-middleware at unlocked-contracts v0.1.0.
• Merge order: merge after the repo is renamed to unlocked-core, or main stops building images.
• After it merges: run git remote set-url origin git@github.com:UnlockedLabs/unlocked-core.git, rebase open branches, and in Go branches replace "UnlockEdv2/ with "github.com/UnlockedLabs/unlocked-core/backend/ in imports.
• What to check: the four go.mod files and .github/. The .go changes are import lines only.

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 170 files, which is 70 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 9f0cba4f-3560-46c7-9049-40d544b498cc

📥 Commits

Reviewing files that changed from the base of the PR and between c1a1a1b and ddc1c68.

⛔ Files ignored due to path filters: 6

• backend/go.sum is excluded by !**/*.sum
• backend/migrations/go.sum is excluded by !**/*.sum
• backend/seeder/go.sum is excluded by !**/*.sum
• go.work is excluded by !**/*.work
• go.work.sum is excluded by !**/*.sum
• provider-middleware/go.sum is excluded by !**/*.sum

📒 Files selected for processing: 170

• .github/PULL_REQUEST_TEMPLATE.md
• .github/merge.sh
• .github/workflows/container_builds.yml
• .github/workflows/go_test.yml
• .github/workflows/security-go.yml
• CONTRIBUTING.md
• backend/cmd/main.go
• backend/go.mod
• backend/migrations/go.mod
• backend/migrations/main.go
• backend/seeder/go.mod
• backend/seeder/main.go
• backend/src/csv.go
• backend/src/database/DB.go
• backend/src/database/activity.go
• backend/src/database/calendar_test.go
• backend/src/database/canvas_programs.go
• backend/src/database/class_enrollments.go
• backend/src/database/class_events.go
• backend/src/database/courses.go
• backend/src/database/dashboard.go
• backend/src/database/delete_guards.go
• backend/src/database/events_attendance.go
• backend/src/database/facilities.go
• backend/src/database/facility_feature_access.go
• backend/src/database/facility_feature_access_test.go
• backend/src/database/facility_visibility.go
• backend/src/database/feature_access.go
• backend/src/database/helpful_links.go
• backend/src/database/instructor_conflicts.go
• backend/src/database/job.go
• backend/src/database/knowledge_center.go
• backend/src/database/learning_record.go
• backend/src/database/libraries.go
• backend/src/database/oidc_client.go
• backend/src/database/open_content.go
• backend/src/database/outcomes.go
• backend/src/database/program_classes.go
• backend/src/database/programs.go
• backend/src/database/programs_insights.go
• backend/src/database/provider_platforms.go
• backend/src/database/provider_user_mappings.go
• backend/src/database/reports.go
• backend/src/database/rooms.go
• backend/src/database/seed_demo.go
• backend/src/database/tags.go
• backend/src/database/user_activity.go
• backend/src/database/user_catalog.go
• backend/src/database/users.go
• backend/src/database/videos.go
• backend/src/handlers/actions.go
• backend/src/handlers/activity_handler.go
• backend/src/handlers/auth.go
• backend/src/handlers/canvas_classes_cache.go
• backend/src/handlers/canvas_classes_cache_test.go
• backend/src/handlers/canvas_events_cache.go
• backend/src/handlers/canvas_programs.go
• backend/src/handlers/canvas_programs_test.go
• backend/src/handlers/class_enrollments.go
• backend/src/handlers/class_enrollments_test.go
• backend/src/handlers/class_events.go
• backend/src/handlers/classes_handler.go
• backend/src/handlers/courses_handler.go
• backend/src/handlers/dashboard.go
• backend/src/handlers/demo_seed_handler.go
• backend/src/handlers/essential_ed_programs.go
• backend/src/handlers/essential_ed_programs_test.go
• backend/src/handlers/events_attendance_handler.go
• backend/src/handlers/external_providers.go
• backend/src/handlers/facilities_handler.go
• backend/src/handlers/facility_feature_access.go
• backend/src/handlers/helpful_links_handler.go
• backend/src/handlers/learning_record_handler.go
• backend/src/handlers/libraries_handler.go
• backend/src/handlers/live_provider.go
• backend/src/handlers/login_flow.go
• backend/src/handlers/middleware.go
• backend/src/handlers/oidc.go
• backend/src/handlers/open_content_activity_handler.go
• backend/src/handlers/open_content_handler.go
• backend/src/handlers/ory.go
• backend/src/handlers/outcomes_handler.go
• backend/src/handlers/program_class_tier_handler.go
• backend/src/handlers/programs_handler.go
• backend/src/handlers/provider_platform_handler.go
• backend/src/handlers/provider_user_management.go
• backend/src/handlers/provider_user_mapping_handler.go
• backend/src/handlers/proxy_handler.go
• backend/src/handlers/reports_handler.go
• backend/src/handlers/server.go
• backend/src/handlers/service_error.go
• backend/src/handlers/user_handler.go
• backend/src/handlers/user_matching.go
• backend/src/handlers/utils.go
• backend/src/handlers/video_handler.go
• backend/src/handlers/websockets.go
• backend/src/jasper/jasper_service.go
• backend/src/models/feature_flags.go
• backend/src/models/jobs.go
• backend/src/models/users.go
• backend/src/service.go
• backend/src/services/classes.go
• backend/src/services/content_visibility.go
• backend/src/services/users.go
• backend/src/tasks/scheduler.go
• backend/src/tasks/tasks.go
• backend/tests/integration/attendance_reason_test.go
• backend/tests/integration/attendance_validation_test.go
• backend/tests/integration/audit_tracking_test.go
• backend/tests/integration/canvas_programs_test.go
• backend/tests/integration/class_date_synchronization_test.go
• backend/tests/integration/class_delete_cascade_test.go
• backend/tests/integration/class_delete_guard_test.go
• backend/tests/integration/class_enrollments_test.go
• backend/tests/integration/class_events_multirow_test.go
• backend/tests/integration/class_instructor_preload_test.go
• backend/tests/integration/classes_test.go
• backend/tests/integration/conflict_detection_test.go
• backend/tests/integration/content_facility_visibility_test.go
• backend/tests/integration/csrf_test.go
• backend/tests/integration/department_metrics_test.go
• backend/tests/integration/enrollment_class_id_test.go
• backend/tests/integration/event_instructor_change_test.go
• backend/tests/integration/facilities_test.go
• backend/tests/integration/facility_comparison_test.go
• backend/tests/integration/facility_delete_guard_test.go
• backend/tests/integration/facility_feature_flags_test.go
• backend/tests/integration/favorites_feature_gating_test.go
• backend/tests/integration/instructor_conflict_test.go
• backend/tests/integration/knowledge_center_test.go
• backend/tests/integration/library_facility_visibility_test.go
• backend/tests/integration/login_flow_test.go
• backend/tests/integration/login_trend_test.go
• backend/tests/integration/program_completion_flag_test.go
• backend/tests/integration/program_delete_guard_test.go
• backend/tests/integration/program_insights_engagement_test.go
• backend/tests/integration/program_insights_enrollment_by_type_test.go
• backend/tests/integration/program_insights_load_test.go
• backend/tests/integration/program_insights_matrix_test.go
• backend/tests/integration/program_insights_second_enrollment_test.go
• backend/tests/integration/program_outcomes_report_test.go
• backend/tests/integration/programs_handler_test.go
• backend/tests/integration/programs_stats_test.go
• backend/tests/integration/reports_database_test.go
• backend/tests/integration/reports_test.go
• backend/tests/integration/resident_programs_feature_test.go
• backend/tests/integration/room_conflict_test.go
• backend/tests/integration/rrule_until_integration_test.go
• backend/tests/integration/testenv.go
• backend/tests/integration/upload_handler_test.go
• backend/tests/integration/user_attendance_export_test.go
• backend/tests/integration/user_matching_test.go
• backend/tests/integration/username_case_insensitive_test.go
• backend/tests/integration/users_test.go
• provider-middleware/Dockerfile
• provider-middleware/brightspace.go
• provider-middleware/brightspace_data.go
• provider-middleware/canvas.go
• provider-middleware/dev.Dockerfile
• provider-middleware/go.mod
• provider-middleware/handlers.go
• provider-middleware/kiwix.go
• provider-middleware/kiwix_data.go
• provider-middleware/kolibri.go
• provider-middleware/kolibri_data.go
• provider-middleware/main.go
• provider-middleware/middleware.go
• provider-middleware/middleware_helpers.go
• provider-middleware/program_classes.go
• provider-middleware/video_dl.go

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[corypride]

Approving. Verified locally on Go 1.26.9:

• All four modules (backend, migrations, seeder, provider-middleware) build with GOWORK=off, and go mod tidy -diff and go mod verify are clean.
• Backend go test ./... passes, and go vet / gofmt are clean.
• govulncheck is clean on this branch. main on Go 1.26.6 still shows GO-2026-6617, so this PR is what fixes it.
• unlocked-contracts v0.1.0 matches the old constants exactly: all 9 features (same order in features.All), the 4 roles plus AdminRoles, and the 9 job types, with the same PubName / IsVideoJob / IsLibraryJob behavior. Since the models are type aliases, stored values and NATS subjects don't change.
• The rename commit is import lines only.

Question before merge: since the repo rename, GitHub's OIDC token says repo:UnlockedLabs/unlocked-core:…. Does the trust policy on the AWS_IAM_ROLE role allow that, or does it still only allow UnlockEdv2? If it's the old name, the first push to main will fail at "Configure AWS credentials" and no images will build. I couldn't check this myself because I don't have iam:ListRoles.

Non-blocking: the rename left the github.com/UnlockedLabs/... imports inside the stdlib import group, so goimports -l now flags 128 files (1 on main). Adding a commit that runs go run golang.org/x/tools/cmd/goimports@latest -w backend provider-middleware would keep everyone's organize-imports-on-save from reshuffling them during the post-rename rebases.

[carddev81]

Thanks @corypride IAM is covered: GithubActionsBuildPushEcr already allows repo:UnlockedLabs/unlocked-core:*, and I’ll remove the old UnlockEdv2 line once the first main build lands in ECR. I also gave you access to that role, so you can check it yourself:

run this on your shell:
aws iam get-role --role-name GithubActionsBuildPushEcr

Added your goimports commit. It only reorders imports (128 files), and everything still builds and passes. Merging once CI is green.