What version of Go are you using (go version)?

$ go version
go version go1.16.2 linux/amd64

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

amd64, linux

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="redacted/.cache/go-build"
GOENV="redacted/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="redacted/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="redacted/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="redacted/go1.16.2.linux.amd64"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="redacted/go1.16.2.linux.amd64/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.16.2"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="redacted/embedtest/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build424344437=/tmp/go-build -gno-record-gcc-switches"

What did you do?

• Create a new Go module.
• Create the directories ./files and ./files/subdir
• Create the files: ./files/file, ./files/-file
• Add the following source to ./main.go

package main

import (
	"embed"
	"fmt"
	"io/fs"
)

//go:embed files
var files embed.FS

func main() {
	err := fs.WalkDir(files, "files", walk)
	if err != nil {
		panic(err)
	}
}

func walk(path string, d fs.DirEntry, _ error) error {
	fmt.Println(path)
	return nil
}

• Run with go run .

What did you expect to see?

files
files/-file
files/file
files/subdir/-file

What did you see instead?

files
files/file

Analysis

This behavior was introduced with commit 930c2c9 where isBadEmbedName has been extended with if err := module.CheckFilePath(name); err != nil {.
The thing with module.CheckFilePath is, that it expects a full path as argument. For such a path, the first segment is not allowed to start with a - (dash) according to https://github.com/golang/mod/blob/d6ab96f2441f9631f81862375ef66782fc4a9c12/module/module.go#L374.
In the case of isBadEmbedName, the function module.CheckFilePath is called with the filename only (without the rest of the path), which prevents any file, starting with - to be embedded.

This behavior is nowhere documented. The current documentation only mentions, that files starting with . and _ are ignored.

Additionally, nor the documentation of module.CheckFilePath neither of module.CheckImportPath do mention, that paths starting with - are not allowed.

Related: #45197, #43854, #44486

Update: add #44486 as related issue