ci: adopt OSS CI and supply-chain best practices

[wiebe-vandendriessche]

Summary

Brings CI in line with what large Go OSS projects (Kubernetes, Syft/Grype, cosign, Helm) use as a baseline, and removes the flaky online integration workflow.

build.yml

• integration.yml deleted ([fix] remove integration GH actions #39): 4 of 6 jobs hit huggingface.co unauthenticated (rate limits / upstream drift), go run recompiled 1+2N times per job, the dist cache was a no-op, and it wasn't part of the required gate. Its offline value is kept as one dummy-mode smoke step (scan → validate --strict → completeness).
• go-version-file: go.mod (no more 1.27.x in 3 places), go mod tidy -diff (the old go mod tidy never failed), go test -race. The 50% coverage gate from Refactor: remove dead code and duplication (~3.2k lines) #60 is kept (currently 54.5%).
• govulncheck replaces the Syft+Grype+jq gate: Go-native and reachability-aware.
• New zizmor job (workflow security linter); the required build gate now covers test + zizmor.
• Top-level permissions: contents: read, concurrency with cancel-in-progress, timeout-minutes, persist-credentials: false.

Supply chain

• Every action pinned by full commit SHA with a version comment; Dependabot now also tracks github-actions (both ecosystems weekly, grouped).
• New codeql.yml (Go) and scorecard.yml (OpenSSF Scorecard + README badge).
• Release: GoReleaser sboms: generates a CycloneDX SBOM per shipped archive (previously the SBOM described a separate go build, not the release binaries); cosign keyless-signs checksums.txt (previously only the vulnerability report was signed); actions/attest-build-provenance adds SLSA provenance; goreleaser pinned to ~> v2; Go cache disabled in release builds (cache-poisoning).

Misc

• go mod tidy: Refactor: remove dead code and duplication (~3.2k lines) #60 left go.mod untidy (spf13/pflag is now a direct dependency), which the new tidy -diff check caught.
• .golangci.yml: gofmt + goimports formatters. Fixed the 7 //. doc-comment lines that failed gofmt.
• README: removed integration badge, added Scorecard badge, Go badge 1.25+ → 1.27+ (matches go.mod).

Related issue

Closes #39
Closes #61

Type of change

CI / config only. No code behavior change.

Verification

• actionlint: clean
• zizmor --offline: no findings
• goreleaser check + goreleaser release --snapshot --clean --skip=sign: builds all 6 archives and a .cdx.json SBOM per archive
• go test -race ./..., golangci-lint run (with formatters), go mod tidy -diff, govulncheck ./...: all pass
• Smoke step run locally against the dummy BOM: passes

Notes for maintainers

• Scorecard publishing and SARIF upload need code scanning enabled on the repo (public repos: free).
• Branch protection: the required check stays named build.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.