Tobias Gesellchen 7da18d3a8c Replace unavailable gosec with comprehensive security scanning ...

- Replace gosec with govulncheck (official Go vulnerability scanner)
- Add dedicated security.yml workflow with multiple tools:
  - govulncheck: Official Go team vulnerability scanner
  - Nancy: Sonatype dependency vulnerability scanner
  - Staticcheck: Go static analysis with security checks
  - Semgrep: Multi-language security scanner
  - CodeQL: GitHub semantic security analysis
  - Dependency Review: Automated dependency vulnerability checking
- Update golangci-lint config to temporarily disable gosec
- Add CodeQL configuration for enhanced Go security analysis
- Separate fast CI checks from comprehensive security scanning
- Schedule daily security scans at 2 AM UTC
- Integrate with GitHub Security tab via SARIF reports

2026-01-09 13:27:06 +01:00

..

ci.yml

Replace unavailable gosec with comprehensive security scanning

2026-01-09 13:27:06 +01:00

release.yml

ci(deps): bump the actions-core group with 6 updates (#4)

2026-01-09 13:02:09 +01:00

security.yml

Replace unavailable gosec with comprehensive security scanning

2026-01-09 13:27:06 +01:00