feat(languages): go sec pipeline

.github/workflows/languages-go-security.yml

@@ -0,0 +1,87 @@
+name: Go Security
+
+on:
+  workflow_call:
+    inputs:
+      go-version-file:
+        description: "Path to go.mod for version resolution"
+        type: string
+        default: "go.mod"
+
+jobs:
+  license:
+    name: licence check (trivy)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Trivy
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
+      - name: Write Trivy config
+        run: |
+          {
+            echo "scan:"
+            echo "  scanners:"
+            echo "    - license"
+            echo "license:"
+            echo "  forbidden:"
+            echo "    - GPL-2.0"
+            echo "    - GPL-3.0"
+            echo "    - AGPL-3.0"
+            echo "    - SSPL"
+            echo "  restricted:"
+            echo "    - LGPL-2.1"
+            echo "    - LGPL-3.0"
+          } > /tmp/trivy-license.yaml
+
+      - name: Scan licences (full report)
+        run: |
+          trivy fs \
+            --config /tmp/trivy-license.yaml \
+            --format json \
+            --output trivy-license-report.json \
+            --exit-code 0 \
+            .
+
+      - name: Upload licence report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-license-report
+          path: trivy-license-report.json
+          retention-days: 7
+
+      - name: Fail on forbidden licences
+        run: |
+          trivy fs \
+            --config /tmp/trivy-license.yaml \
+            --severity CRITICAL \
+            --exit-code 1 \
+            .
+
+  vuln:
+    name: vulnerability check (govulncheck)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: ${{ inputs.go-version-file }}
+          cache: true
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run govulncheck
+        run: govulncheck -json ./... > govulncheck-report.json
+
+      - name: Upload vulnerability report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: govulncheck-report
+          path: govulncheck-report.json
+          retention-days: 7