CI dependency hygiene: pin govulncheck, pin devcontainer image, bump golangci-lint and actions #187

Summary

Three CI dependency-hygiene gaps in an otherwise fully pinned pipeline: govulncheck runs at @latest, the devcontainer image is tag-only and outside Dependabot, and four action or tool versions are a step behind (one of them a literal Dependabot cannot touch).

Where

• .github/workflows/go.yml:98 (go run golang.org/x/vuln/cmd/govulncheck@latest ./...)
• .devcontainer/devcontainer.json:3, .devcontainer/labs/devcontainer.json:3 (mcr.microsoft.com/devcontainers/go:1.26-bookworm, no digest), .github/dependabot.yml:31-40 (no devcontainers ecosystem)
• .github/workflows/go.yml:92 (golangci-lint version: v2.14.0), :199 (goreleaser-action v7.2.3), :260 (cosign-installer v4.1.2), action.yml:204 (upload-artifact v7.0.1)

Details

• Pin govulncheck to a release (golang.org/x/vuln/cmd/[email protected]) or use the SHA-pinned golang/govulncheck-action
• Pin the devcontainer images by @sha256: digest (or at least move to the 1.27 tag the Dockerfile uses) and add package-ecosystem: "devcontainers" to dependabot.yml
• golangci-lint version: v2.14.0 -> v2.15.0 (literal; bump by hand)
• goreleaser/goreleaser-action v7.2.3 -> v7.3.0, sigstore/cosign-installer v4.1.2 -> v4.1.3, actions/upload-artifact v7.0.1 -> v7.0.2 (weekly github-actions Dependabot group)

Impact

Reproducibility: an upstream govulncheck regression breaks CI with no changed input; Codespaces and the devcontainer CI job float with the upstream tag.

Acceptance criteria

• No @latest in workflows
• Devcontainer images digest-pinned and covered by Dependabot

Getting started

• Relevant files: .github/workflows/go.yml, .github/dependabot.yml, .devcontainer/*.json
• How to run tests: the workflows themselves

_{Filed by repo-audit/full-audit at 3139c44. Severity: low. Effort: S. audit-key: dependencies|.github/workflows/go.yml|golang.org/x/vuln}