correct the module name, correct oci metadata, and try running tests in CI

.github/workflows/ci.yaml

@@ -0,0 +1,104 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+    # sidecar/ is the only Go module in this repo; skip CI for changes that
+    # cannot affect it (web/, ansible/, docs).
+    paths:
+      - "sidecar/**"
+      - ".github/workflows/ci.yaml"
+
+# Cancel in-progress runs for the same ref (PR or branch) when new commits land.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  GO_VERSION: "1.26"
+
+defaults:
+  run:
+    working-directory: sidecar
+
+jobs:
+  lint:
+    name: Lint & format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: true
+          cache-dependency-path: sidecar/go.sum
+
+      - name: Verify gofmt
+        run: |
+          unformatted=$(gofmt -l .)
+          if [ -n "$unformatted" ]; then
+            echo "::error::The following files are not gofmt-formatted:"
+            echo "$unformatted"
+            echo "Run 'gofmt -w .' to fix."
+            exit 1
+          fi
+
+      - name: go vet
+        run: go vet ./...
+
+      - name: Verify go.mod is tidy
+        run: |
+          go mod tidy
+          if ! git diff --exit-code -- go.mod go.sum; then
+            echo "::error::go.mod/go.sum are not tidy. Run 'go mod tidy' and commit the result."
+            exit 1
+          fi
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.12.2
+          # `defaults.run` does not apply to actions, so point it at the module.
+          working-directory: sidecar
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+
+    # No service container: internal/redistest starts its own Redis on the
+    # runner's Docker daemon. GitHub sets CI=true, which makes it fail rather
+    # than skip, so the persistence layer cannot drop out of this job.
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: true
+          cache-dependency-path: sidecar/go.sum
+
+      - name: Run tests (race + coverage)
+        run: go test -race -coverprofile=cover.out -covermode=atomic ./...
+
+      - name: Coverage summary
+        run: go tool cover -func=cover.out | tail -1
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: true
+          cache-dependency-path: sidecar/go.sum
+
+      - name: go build
+        env:
+          CGO_ENABLED: "0"
+        run: go build -ldflags="-s -w" ./...

.github/workflows/govulncheck.yaml

@@ -0,0 +1,42 @@
+name: Vulnerability check
+
+on:
+  pull_request:
+    branches: [main]
+    # sidecar/ is the only Go module in this repo.
+    paths:
+      - "sidecar/**"
+      - ".github/workflows/govulncheck.yaml"
+  schedule:
+    # Weekly scan so newly disclosed CVEs in pinned deps surface even
+    # without a code change. Mondays at 07:00 UTC.
+    - cron: "0 7 * * 1"
+
+concurrency:
+  group: govulncheck-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    working-directory: sidecar
+
+jobs:
+  govulncheck:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: "1.26"
+          check-latest: true
+          cache-dependency-path: sidecar/go.sum
+
+      - name: Run govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...

sidecar/Dockerfile

@@ -65,7 +65,7 @@ ARG BUILD_DATE
 
 LABEL org.opencontainers.image.title="zot-ephemeral-ttl" \
       org.opencontainers.image.description="Tag-driven TTL sidecar for zot. Subscribes to image.updated CloudEvents and DELETEs expired manifests." \
-      org.opencontainers.image.source="https://github.com/nullbytelabs/zot-ephemeral-ttl" \
+      org.opencontainers.image.source="https://github.com/replicatedhq/ttl.sh" \
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.version="${VERSION}" \
       org.opencontainers.image.revision="${COMMIT}" \

sidecar/cmd/zot-ephemeral-ttl/main.go

@@ -9,8 +9,8 @@ import (
 	"os/signal"
 	"syscall"
 
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/app"
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/config"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/app"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/config"
 )
 
 // Build metadata, set via -ldflags "-X main.version=..." in the Dockerfile.

sidecar/go.mod

@@ -1,4 +1,4 @@
-module github.com/nullbytelabs/zot-ephemeral-ttl
+module github.com/replicatedhq/ttl.sh/sidecar
 
 go 1.26
 

sidecar/internal/app/app.go

@@ -13,11 +13,11 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/config"
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/reaper"
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/registry"
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/server"
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/store"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/config"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/reaper"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/registry"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/server"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/store"
 )
 
 // storeBackend is the union of persistence capabilities app injects into the

sidecar/internal/app/app_test.go

@@ -6,8 +6,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/config"
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/redistest"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/config"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/redistest"
 )
 
 // The startup-path test needs a real Redis; redistest starts one per package.

sidecar/internal/reaper/reaper.go

@@ -9,7 +9,7 @@ import (
 	"log"
 	"time"
 
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/store"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/store"
 )
 
 // Store is the subset of the persistence layer the reaper needs.

sidecar/internal/reaper/reaper_test.go

@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/store"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/store"
 )
 
 // In-memory fakes for the reaper's two dependencies. No real DB, no real HTTP.

sidecar/internal/server/server.go

@@ -8,8 +8,8 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/events"
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/ttl"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/events"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/ttl"
 )
 
 // Store is the subset of the persistence layer the server needs.

sidecar/internal/server/server_test.go

@@ -12,8 +12,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/events"
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/store"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/events"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/store"
 )
 
 // Server.Store is documented as safe for concurrent use, so the fake locks its

sidecar/internal/store/store_test.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/redis/go-redis/v9"
 
-	"github.com/nullbytelabs/zot-ephemeral-ttl/internal/redistest"
+	"github.com/replicatedhq/ttl.sh/sidecar/internal/redistest"
 )
 
 // These tests run against a real Redis, started for the package by redistest.