license: add copyright preamble and per-file SPDX headers #5

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	test:
	strategy:
	fail-fast: false
	matrix:
	os: [ubuntu-latest, macos-latest]
	go: ["1.22", "1.23", "1.24"]
	runs-on: ${{ matrix.os }}
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-go@v5
	with:
	go-version: ${{ matrix.go }}
	cache: true
	- run: go vet ./...
	- run: go build ./...
	- run: go test -race -count=1 ./...

	lint:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-go@v5
	with:
	go-version: stable
	cache: true
	- uses: golangci/golangci-lint-action@v7
	with:
	version: v2.11.3

	vuln:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-go@v5
	with:
	# govulncheck uses the toolchain's stdlib version when scanning;
	# pin to the latest patched Go so stdlib vulns (net, net/url,
	# database/sql, etc.) don't false-fail on dependency-reachable code.
	go-version: stable
	cache: true
	- name: govulncheck
	run: \|
	go install golang.org/x/vuln/cmd/govulncheck@latest
	govulncheck ./...

	gosec:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: gosec
	uses: securego/gosec@master
	with:
	# G505 (crypto/sha1): Chromium's PBKDF2 mandates SHA-1; this is
	# interop, not our crypto choice. The decrypt path uses a fixed
	# IV (G407) by Chromium specification; the encrypt-with-fixed-IV
	# helper lives only in _test.go and gosec doesn't scan tests.
	args: -exclude=G505 ./...

Provide feedback