fix(golang): reject // indirect //exhortignore as ignore marker (TC-4345)

The greedy regex in IgnoredLine matched the last // in a line, causing
"// indirect //exhortignore" to be incorrectly treated as ignored.
Parse the first // comment instead and only accept standalone ignore
markers or the semicolon-separated format (// indirect; exhortignore),
matching the JavaScript client behavior.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: a-oren

src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java

@@ -560,32 +560,32 @@ private String extractPackageName(String line) {
   public boolean IgnoredLine(String line) {
     boolean result = false;
     if (IgnorePatternDetector.containsIgnorePattern(line)) {
-      // if exhortignore or trustify-da-ignore is alone in a comment or is in a comment together
-      // with indirect or as a
-      // comment inside a
-      // comment ( e.g // indirect  //exhort)
-      // then this line is to be checked if it's a comment after a package name.
-      if (Pattern.matches(".+//\\s*(exhortignore|trustify-da-ignore)", line)
-          || Pattern.matches(
-              ".+//\\s*indirect\\s*;\\s*(//)?\\s*(exhortignore|trustify-da-ignore)", line)) {
-        String trimmedRow = line.trim();
-        // filter out lines where exhortignore or trustify-da-ignore has no meaning
-        if (!trimmedRow.startsWith("module ")
-            && !trimmedRow.startsWith("go ")
-            && !trimmedRow.startsWith("require (")
-            && !trimmedRow.startsWith("require(")
-            && !trimmedRow.startsWith("exclude ")
-            && !trimmedRow.startsWith("replace ")
-            && !trimmedRow.startsWith("retract ")
-            && !trimmedRow.startsWith("use ")
-            && !trimmedRow.contains(
-                "=>")) { // only for lines that after trimming starts with "require " or starting
-          // with
-          // package name followd by one space, and then a semver version.
-          if (trimmedRow.startsWith("require ")
-              || Pattern.matches(
-                  "^[a-z.0-9/-]+\\s{1,2}[vV][0-9]\\.[0-9](\\.[0-9]){0,2}.*", trimmedRow)) {
-            result = true;
+      String trimmedRow = line.trim();
+      int firstComment = trimmedRow.indexOf("//");
+      if (firstComment >= 0) {
+        String comment = trimmedRow.substring(firstComment + 2).trim();
+        // Match standalone ignore pattern (e.g. "// exhortignore") or
+        // semicolon-separated with indirect (e.g. "// indirect; exhortignore",
+        // "// indirect; // exhortignore").
+        // Does NOT match "// indirect //exhortignore" (no semicolon) or
+        // "// indirect exhortignore" (space-separated) — these are incorrect formats.
+        if (comment.matches("(exhortignore|trustify-da-ignore)")
+            || comment.matches("indirect\\s*;\\s*(//)?\\s*(exhortignore|trustify-da-ignore)")) {
+          // filter out lines where exhortignore or trustify-da-ignore has no meaning
+          if (!trimmedRow.startsWith("module ")
+              && !trimmedRow.startsWith("go ")
+              && !trimmedRow.startsWith("require (")
+              && !trimmedRow.startsWith("require(")
+              && !trimmedRow.startsWith("exclude ")
+              && !trimmedRow.startsWith("replace ")
+              && !trimmedRow.startsWith("retract ")
+              && !trimmedRow.startsWith("use ")
+              && !trimmedRow.contains("=>")) {
+            if (trimmedRow.startsWith("require ")
+                || Pattern.matches(
+                    "^[a-z.0-9/-]+\\s{1,2}[vV][0-9]\\.[0-9](\\.[0-9]){0,2}.*", trimmedRow)) {
+              result = true;
+            }
           }
         }
       }

src/test/java/io/github/guacsec/trustifyda/providers/Golang_Modules_Provider_Test.java

@@ -239,6 +239,13 @@ void test_IgnoredLine_rejects_old_space_separated_indirect_format() {
         .isFalse();
     assertThat(provider.IgnoredLine("        github.com/foo/bar v1.0.0 // indirect exhortignore"))
         .isFalse();
+    // Double-slash without semicolon should NOT be recognized (TC-4345)
+    assertThat(
+            provider.IgnoredLine(
+                "        github.com/foo/bar v1.0.0 // indirect //trustify-da-ignore"))
+        .isFalse();
+    assertThat(provider.IgnoredLine("        github.com/foo/bar v1.0.0 // indirect //exhortignore"))
+        .isFalse();
     // New semicolon format should still be recognized
     assertThat(
             provider.IgnoredLine(