Replace Dependabot gomod with govulncheck and test-against-latest

[michaeldwan]

Dependabot's Go dependency PRs are high-noise, low-signal. Most bumps are transitive deps with CVEs we don't even call, and every PR fights the merge queue over go.sum conflicts. See https://words.filippo.io/dependabot for the argument.

Two new scheduled workflows replace it:

• govulncheck (daily + push/PR) -- symbol-level vulnerability scanning. Only fires when our code actually calls a vulnerable function, not just because a transitive dep has a CVE.
• go-latest-deps (daily, informational) -- runs the test suite after go get -u -t ./.... Catches upstream breakage early without forcing us to merge anything. Failures don't gate PRs.

Go deps get updated on our schedule now, not each dependency's. The pip, cargo, and github-actions Dependabot entries are untouched.

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

Summary: Replaces Dependabot Go updates with symbol-level vulnerability scanning (govulncheck) and daily tests against latest dependencies.

Issue:

In .github/workflows/govulncheck.yaml, using go-version-file: go.mod with go run golang.org/x/vuln/cmd/govulncheck@latest works, but there's a subtle issue: go run at latest may require a newer Go toolchain than specified in go.mod. If the Go version in go.mod lags behind what govulncheck requires, this will fail.

    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: actions/setup-go@v6
        with:
          go-version: stable
      - name: Run govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

This matches the pattern in go-latest-deps.yaml and ensures you always have a recent Go toolchain capable of running the latest govulncheck.

github run

[ask-bonk]

LGTM

github run

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

Summary: Replaces Dependabot Go updates with symbol-level vulnerability scanning (govulncheck) and daily tests against latest dependencies.

Issue:

In .github/workflows/govulncheck.yaml, using go-version-file: go.mod with go run golang.org/x/vuln/cmd/govulncheck@latest works, but there's a subtle issue: go run at latest may require a newer Go toolchain than specified in go.mod. If the Go version in go.mod lags behind what govulncheck requires, this will fail.

    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: actions/setup-go@v6
        with:
          go-version: stable
      - name: Run govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

This matches the pattern in go-latest-deps.yaml and ensures you always have a recent Go toolchain capable of running the latest govulncheck.

github run