feat: add code-scanning workflow with golangci-lint and govulncheck

[Copilot]

Adds a GitHub Advanced Security code-scanning workflow running golangci-lint and govulncheck, each uploading SARIF results via codeql-action/upload-sarif.

Changes

tools/go.mod

• New isolated Go module using the Go 1.24+ tool directive to pin golang.org/x/vuln/cmd/govulncheck without polluting the root module

Makefile

• New govulncheck target invoking the tool via the separate modfile:

  govulncheck:
      go tool -modfile tools/go.mod govulncheck ./...

.github/workflows/code-scanning.yml

• Two jobs triggered on push/PR to main:
  • golangci-lint — runs via golangci-lint-action@1e7e51e7 # v9.2.0 with explicit version: v2.12.1 and --output-formats=sarif:golangci-lint.sarif
  • govulncheck — runs go tool -modfile tools/go.mod govulncheck -format sarif ./...
• Both upload SARIF to GitHub Advanced Security via github/codeql-action/upload-sarif@e46ed2cb # v4.35.3 with if: always() to surface findings even on non-zero exit
• All action references are pinned to full commit SHAs with version comments

.github/dependabot.yml

• Added gomod entry for tools/ so Dependabot keeps govulncheck current

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/golangci/golangci-lint-action/git/ref/tags/v9.2.0
  • Triggering command: /usr/bin/gh gh api /repos/golangci/golangci-lint-action/git/ref/tags/v9.2.0 --jq .object.sha (http block)
• https://api.github.com/repos/golangci/golangci-lint/releases/latest
  • Triggering command: /usr/bin/gh gh api /repos/golangci/golangci-lint/releases/latest --jq .tag_name (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.