ci: add Tier 1 security pipelines (govulncheck, CodeQL, Trivy)

The existing CI gates (lint + test + coverage) catch correctness
defects but not external risk: known CVEs in deps, source-level
injection patterns, OS-package CVEs in the published Docker image.
Adds three independent pipelines for those failure modes.

- .github/workflows/govulncheck.yml — Go's official vulnerability
  scanner, runs govulncheck ./... over source + go.mod and reports
  only CVEs that the call graph actually reaches. Triggers on push,
  PR, and Friday cron.
- .github/workflows/codeql.yml — GitHub-native SAST. security-and-
  quality query suite. Results land in the Security tab and as PR
  annotations. Same trigger cadence.
- .github/workflows/trivy.yml — scans the published Docker image
  (alpine + altair binary) for HIGH/CRITICAL OS-level CVEs. Output
  goes to the Security tab as SARIF; doesn't fail the build initially
  (ignore-unfixed=true, exit-code=0) so humans can triage. Flip both
  knobs once the team is comfortable.

Each is a separate workflow rather than a job inside general.yml so
that (a) failures don't block correctness PRs, (b) cadences can
diverge, (c) Security-tab routing stays clean per analyzer.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: insomnius

.github/workflows/codeql.yml

@@ -0,0 +1,54 @@
+name: CodeQL
+
+# GitHub's native SAST. Free for public repos. Catches injection patterns,
+# unsafe deserialization, hardcoded credentials, etc. Results show in the
+# Security tab and as PR annotations.
+#
+# Runs ~3-5 minutes; long enough to make weekly + push the right cadence
+# rather than per-PR (which would block merges on a slow analyzer).
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    - cron: '0 13 * * 5'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (Go)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: stable
+          check-latest: true
+          cache: true
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: go
+          # `security-and-quality` is broader than `security-extended` and
+          # catches code-quality issues; flip to `security-extended` if the
+          # noise outweighs the value.
+          queries: security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: '/language:go'

.github/workflows/govulncheck.yml

@@ -0,0 +1,41 @@
+name: govulncheck
+
+# Go's official vulnerability scanner. Reads go.mod + the actual call graph
+# of the source and cross-references against vuln.go.dev. More precise than
+# Dependabot — only flags CVEs that your code actually reaches.
+#
+# Runs in ~10 seconds on this repo. Failure here is a real "fix this now"
+# signal, not a noisy "your dep has a CVE somewhere" advisory.
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    # Catch newly-disclosed CVEs in deps that didn't change. Friday morning
+    # so a fail lands on a workday.
+    - cron: '0 13 * * 5'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: stable
+          check-latest: true
+          cache: true
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - name: Run govulncheck
+        run: govulncheck ./...

.github/workflows/trivy.yml

@@ -0,0 +1,72 @@
+name: Trivy
+
+# Scans the Docker image we publish to Docker Hub for OS-level CVEs (alpine
+# packages) and Go-binary CVEs. Different surface from govulncheck — that
+# one looks at source + go.mod, this one looks at the actual published
+# artifact.
+#
+# We scan both on PR (to catch a fresh CVE in a base image bump before
+# merge) and on schedule (to catch a newly-disclosed CVE in an unchanged
+# image).
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'Dockerfile'
+      - 'Makefile'
+      - '.github/workflows/trivy.yml'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'Dockerfile'
+      - 'Makefile'
+      - '.github/workflows/trivy.yml'
+  schedule:
+    - cron: '0 13 * * 5'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  image-scan:
+    name: Image scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: stable
+          check-latest: true
+          cache: true
+
+      - name: Build linux binary (matches the production Dockerfile copy step)
+        run: make build_linux
+
+      - name: Build local Docker image for scanning
+        run: docker build -t altair-trivy-scan:local -f ./Dockerfile .
+
+      - name: Scan image for HIGH and CRITICAL vulnerabilities
+        uses: aquasecurity/trivy-action@0.28.0
+        with:
+          image-ref: altair-trivy-scan:local
+          format: sarif
+          output: trivy-results.sarif
+          severity: HIGH,CRITICAL
+          # Don't fail the build immediately on every CVE — populate the
+          # Security tab and let humans triage. Flip ignore-unfixed to
+          # false and exit-code to 1 once you want hard-fail semantics.
+          ignore-unfixed: true
+          exit-code: '0'
+
+      - name: Upload Trivy results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif
+          category: trivy-image