[jferrl]

Summary

Two improvements were asked for: signed releases and govulncheck. Running govulncheck first found a bigger problem. Every release binary is built with Go 1.26.0: the release job sets up Go from go.mod's go 1.26.0, which setup-go takes literally. So every standard-library fix since then ships unpatched, and govulncheck finds 45 reachable vulnerabilities in v1.12.0's binary, in net/http, crypto/tls and crypto/x509 among others. The library is unaffected, since users build it with their own Go. This PR builds releases with the newest stable Go, attests every archive and extension binary, and runs govulncheck.

What this does

	Before	After
Go building the release	1.26.0, from go.mod	Newest stable, currently 1.27.3
Proof a binary came from this repo	checksums.txt, written by the same job	Build provenance attestation per archive and per extension binary: gh attestation verify <file> -R jferrl/go-githubauth
Known vulnerabilities	Never checked	govulncheck on every PR and push to main, and weekly

Changes

• release.yml: setup-go uses go-version: stable, check-latest: true. A new attest job attests every archive in the published checksums.txt; the gh-extension job attests the bare binaries gh installs, between its unpack and publish steps.
• govulncheck.yml: golang/govulncheck-action, pinned, with the same stable Go.
• README shows how to verify a release; CHANGELOG has the Security and Added entries.

Rationale

Archive attestation is its own job because re-running GoReleaser fails on assets it already uploaded, so only a separate job can be retried with "Re-run failed jobs". An adversarial Codex pass found that problem in the first draft, which attested inside the GoReleaser job. A second pass found nothing.

Building with stable means a new major Go can arrive in a release unannounced. That is the trade that keeps the binaries patched, and the test matrix covers 1.26 and 1.27.

Migration Notes

Attestations start with the next release, and v1.12.0's binaries keep the old Go until then. I would cut v1.12.1 with no code change, just this rebuild, which also exercises the new jobs. Verified locally: govulncheck finds nothing in the source with Go 1.27.3; the split extension steps unpack v1.12.0's real archives and behave as before against a stubbed gh.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.75%. Comparing base (c259387) to head (34bd586).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #99   +/-   ##
=======================================
  Coverage   97.75%   97.75%           
=======================================
  Files           9        9           
  Lines         935      935           
=======================================
  Hits          914      914           
  Misses         21       21           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.