Three workflows modeled on kanrisha + Vortex:
* test.yml — on push/PR to main: build + vet + unit tests (-race), a
gated integration job that runs go test -tags=integration ./test/...
(testcontainers spins up Postgres 17 itself; runner must expose the
docker socket), and a lint job (go mod tidy + gofmt check).
* security.yml — govulncheck on push to main plus a weekly Monday
06:00 UTC cron so fresh CVEs surface without a code change.
* release.yml — on v* tag push only: goreleaser v2 with
GORELEASER_FORCE_TOKEN=gitea + GITEA_SERVER_URL, plus a docker
login step so the built image can push to Gitea's registry.
All three pin Go 1.26 (go.mod says 1.26.2). Release job requires the
TOKEN_GITEA repo secret (scope: packages + code:write).
57_Wolve