feat(languages): go sec pipeline

.github/workflows/languages-go-fmt.yml

@@ -0,0 +1,52 @@
+name: Go Format
+
+on:
+  workflow_call:
+    inputs:
+      go-version-file:
+        description: "Path to go.mod for version resolution"
+        type: string
+        default: "go.mod"
+      run-vet:
+        description: "Also run go vet"
+        type: boolean
+        default: true
+
+jobs:
+  fmt:
+    name: gofmt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: ${{ inputs.go-version-file }}
+          cache: true
+
+      - name: Check formatting
+        run: |
+          unformatted=$(gofmt -l .)
+          if [ -n "$unformatted" ]; then
+            echo "::error::The following files are not gofmt-formatted:"
+            echo "$unformatted"
+            echo ""
+            echo "Run: gofmt -w ."
+            exit 1
+          fi
+
+  vet:
+    name: go vet
+    runs-on: ubuntu-latest
+    needs: fmt
+    if: ${{ inputs.run-vet }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: ${{ inputs.go-version-file }}
+          cache: true
+
+      - name: go vet
+        run: go vet ./...

.github/workflows/languages-go-security.yml

@@ -0,0 +1,87 @@
+name: Go Security
+
+on:
+  workflow_call:
+    inputs:
+      go-version-file:
+        description: "Path to go.mod for version resolution"
+        type: string
+        default: "go.mod"
+
+jobs:
+  license:
+    name: licence check (trivy)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Trivy
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
+      - name: Write Trivy config
+        run: |
+          {
+            echo "scan:"
+            echo "  scanners:"
+            echo "    - license"
+            echo "license:"
+            echo "  forbidden:"
+            echo "    - GPL-2.0"
+            echo "    - GPL-3.0"
+            echo "    - AGPL-3.0"
+            echo "    - SSPL"
+            echo "  restricted:"
+            echo "    - LGPL-2.1"
+            echo "    - LGPL-3.0"
+          } > /tmp/trivy-license.yaml
+
+      - name: Scan licences (full report)
+        run: |
+          trivy fs \
+            --config /tmp/trivy-license.yaml \
+            --format json \
+            --output trivy-license-report.json \
+            --exit-code 0 \
+            .
+
+      - name: Upload licence report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-license-report
+          path: trivy-license-report.json
+          retention-days: 7
+
+      - name: Fail on forbidden licences
+        run: |
+          trivy fs \
+            --config /tmp/trivy-license.yaml \
+            --severity CRITICAL \
+            --exit-code 1 \
+            .
+
+  vuln:
+    name: vulnerability check (govulncheck)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: ${{ inputs.go-version-file }}
+          cache: true
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run govulncheck
+        run: govulncheck -json ./... > govulncheck-report.json
+
+      - name: Upload vulnerability report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: govulncheck-report
+          path: govulncheck-report.json
+          retention-days: 7

.github/workflows/languages-go-test.yml

@@ -0,0 +1,52 @@
+name: Go Test
+
+on:
+  workflow_call:
+    inputs:
+      go-version-file:
+        description: "Path to go.mod for version resolution"
+        type: string
+        default: "go.mod"
+      run-race:
+        description: "Enable race detector"
+        type: boolean
+        default: true
+      timeout:
+        description: "Test timeout (go test -timeout)"
+        type: string
+        default: "20m"
+      coverage:
+        description: "Upload coverage report as artifact"
+        type: boolean
+        default: true
+
+jobs:
+  test:
+    name: go test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: ${{ inputs.go-version-file }}
+          cache: true
+
+      - name: Run tests
+        run: |
+          ARGS="-timeout ${{ inputs.timeout }}"
+          if [ "${{ inputs.run-race }}" = "true" ]; then
+            ARGS="$ARGS -race"
+          fi
+          if [ "${{ inputs.coverage }}" = "true" ]; then
+            ARGS="$ARGS -coverprofile=coverage.out -covermode=atomic"
+          fi
+          go test $ARGS ./...
+
+      - name: Upload coverage report
+        if: ${{ inputs.coverage }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage.out
+          retention-days: 7