ci: bump actions and add gofmt/vet/build/govulncheck gates

Bumps actions/checkout to v7, actions/setup-go to v7, and
codecov/codecov-action to v7. Adds strict gofmt, go mod tidy, go vet,
build, and govulncheck checks to CI.

Closes #17

Author: taigrr

.github/workflows/ci.yml

@@ -17,10 +17,10 @@ jobs:
       matrix:
         go-version: ["1.26", "1.26.5"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go ${{ matrix.go-version }}
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ matrix.go-version }}
           cache: true
@@ -40,7 +40,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: matrix.go-version == '1.26.5'
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           files: coverage-user.out,coverage-root.out
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -50,16 +50,53 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: "1.26"
           cache: true
 
+      - name: Check gofmt
+        run: |
+          diff=$(gofmt -l .)
+          if [ -n "$diff" ]; then
+            echo "The following files are not gofmt-formatted:"
+            echo "$diff"
+            exit 1
+          fi
+
+      - name: Verify go mod tidy
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum
+
+      - name: Run go vet
+        run: go vet ./...
+
+      - name: Build
+        run: go build ./...
+
       - name: Run staticcheck
         uses: dominikh/staticcheck-action@v1
         with:
           version: latest
           install-go: false
+
+  govulncheck:
+    name: Govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: "1.26"
+          cache: true
+
+      - name: Run govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...