feat(modules): add nextcloud, jellyfin, forgejo and immich version modules

[TBX3D]

No description provided.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@a38ba0a). Learn more about missing BASE report.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #302   +/-   ##
=======================================
  Coverage        ?   64.90%           
=======================================
  Files           ?       88           
  Lines           ?     7858           
  Branches        ?        0           
=======================================
  Hits            ?     5100           
  Misses          ?     2367           
  Partials        ?      391           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

pr summary

9 files changed (+629 -0)

category	files
go source	4
tests	4

[vmfunc]

the immich module is broken. extractors use type: json but the yaml executor only implements regex (runExtractors, executor.go:361), and the Extractor struct has no json field to unmarshal into (module.go:100). so immich_major/minor/patch never populate, the finding fires with an empty extracted map, and your own immich test (want 3 / want 1) fails against the real executor. i ran it to confirm. swap them to regex like the other three, "major"\s*:\s*([0-9]+) group 1 etc. verified that passes.

the other three are solid. the forgejo +gitea- discriminator is exactly the right call, keeps vanilla gitea (dev builds and v1.x releases) out, and the productname gating on nextcloud/jellyfin cleanly excludes owncloud/emby. checked all three against the real bodies in your tests, they hold.

fix immich and this is in.

[TBX3D]

thanks for actually running it, that is the kind of review that catches real
dead modules. I went to make the swap and could not get it to fail on my end,
so let me show my working before I change anything, in case I am the one
holding it wrong.

I think the tree this was read against predates #191. the json extractor landed
on main on 2026-06-22 in "feat(modules): add json extractor (#191)". on current
main runExtractors has:

case "json":
part := getPart(e.Part, resp, body)
for _, path := range e.JSON {
if r := gjson.Get(part, path); r.Exists() { ... }

at internal/modules/executor.go:526, and Extractor carries
JSON []string \yaml:"json,omitempty"`` at module.go:109. the line numbers in
the review (executor.go:361, module.go:100) match the pre-#191 tree.

rebased the branch onto current main and the immich test passes, including the
two assertions quoted in the review:

--- PASS: TestImmichVersionExposureModule
--- PASS: .../an_exposed_immich_version_endpoint_is_flagged_and_versioned

immich_major=3 and immich_patch=1 both populate. so I have left the extractors
as type: json rather than rewriting them to regex, since that would be a
downgrade for no gain, but say the word if you would still rather they were
regex for consistency with the other three and I will switch them.

[Copilot]

Pull request overview

This PR adds new reconnaissance YAML modules to detect unauthenticated version disclosure endpoints for Nextcloud, Jellyfin, Forgejo, and Immich, along with Go tests that parse and execute each module against an httptest server.

Changes:

• Added 4 new modules/recon/*-version-exposure.yaml HTTP modules to fingerprint and extract exposed version information.
• Added 4 new internal/modules/*_version_exposure_test.go tests to validate matcher behavior and extracted version fields.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
modules/recon/nextcloud-version-exposure.yaml	Adds Nextcloud status endpoint version exposure detection + regex extractor.
modules/recon/jellyfin-version-exposure.yaml	Adds Jellyfin public system info version exposure detection + regex extractor.
modules/recon/immich-version-exposure.yaml	Adds Immich unauthenticated server version detection with header+body matchers and JSON extractors.
modules/recon/forgejo-version-exposure.yaml	Adds Forgejo version API detection via regex and version extractor.
internal/modules/nextcloud_version_exposure_test.go	Tests Nextcloud module match/extract behavior (including non-Nextcloud negatives).
internal/modules/jellyfin_version_exposure_test.go	Tests Jellyfin module match/extract behavior (including Emby negative).
internal/modules/immich_version_exposure_test.go	Tests Immich module match/extract behavior using CORS header and version body.
internal/modules/forgejo_version_exposure_test.go	Tests Forgejo module match/extract behavior and Gitea negatives.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[TBX3D]

the module defines immich_major, immich_minor and immich_patch but the test only
pinned major and patch, so a regression in the middle extractor would have gone
unnoticed. added the minor assertion.

[TBX3D]

CI on this branch is red for a reason unrelated to the change: main does not
build at 2ce359a, internal/modules/executor.go:197 references MaxBodySize after
#355 moved it into internal/httpx, so every branch merged against main fails the
same way:

internal/modules/executor.go:197:57: undefined: MaxBodySize

#374 fixes it. this branch builds and tests clean with that one-line fix applied
on top; no action needed here.