ci: add staticcheck and govulncheck to CI

[leno23]

Summary

• Install and run staticcheck after go vet
• Install and run govulncheck in CI

Test plan

• go test ./...

Fixes #30

Made with Cursor

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 06624ee72b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Run govulncheck with the module's Go version

Because this step does not pass any inputs, golang/govulncheck-action@v1 uses its default go-version-input: stable and re-runs actions/setup-go; the govulncheck docs state that source scans use the go command on PATH as the build configuration. In this repo go.mod targets Go 1.20 and the build/release workflows use go-version-file: go.mod, so a standard-library vulnerability that affects Go 1.20 but is fixed in the latest stable Go would be missed by CI. Pass the same Go version/file into this action (or prevent it from overriding the existing setup) so the vulnerability scan matches the binary being built.

Useful? React with 👍 / 👎.