4 commits

Author	SHA1	Message	Date
lakshit verma	feae493b0f	ci: add staticcheck lint job ... New parallel lint job running Staticcheck (all checks) pinned to 2026.2.1 — the version the codebase was validated against — with the action pinned by commit SHA like the others. Two findings it surfaced on first run are already fixed in the parent commit.	2026-08-24 01:13:01 +05:30
lakshit verma	04a6dc710c	ci: fix govulncheck input name (go-package, not go-package-input) ... go-package-input was silently ignored as an unexpected input, so the intended ./... package argument never reached govulncheck.	2026-08-24 01:06:58 +05:30
lakshit verma	74888a20a9	ci: pin actions to commit SHAs, cancel superseded runs ... Action references by tag (checkout@v4, setup-go@v5, govulncheck-action@v1) execute whatever a retargeted tag points at, so a compromised tag would run with contents:read on this repo. Pin each to the commit SHA its tag resolves to today, and cancel superseded runs on the same ref.	2026-08-24 00:44:53 +05:30
lakshit verma	1de5333ded	ci: build, vet, race tests, and govulncheck on push and PR	2026-08-21 22:26:59 +05:30