ci(security): run govulncheck on every PR

[mateeullahmalik]

Behavior change

Adds a dedicated Go Vulnerability Scan workflow that runs:

go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...

The workflow runs on:

• every pull request, regardless of target branch;
• PR creation through the default pull_request/opened activity;
• every subsequent branch push while the PR is active through pull_request/synchronize;
• reopened PRs through the default pull_request/reopened activity;
• every push to master.

There are deliberately no path filters, advisory flags, baselines, or continue-on-error settings. Reachable findings fail the job.

Rationale

The repository already exposes make vulncheck, but no workflow on current master executes it. This makes reachable Go vulnerabilities visible on every PR and enforces them as a hard CI failure.

The workflow uses Lumera's existing checkout and local setup-Go actions. It invokes the CLI directly rather than golang/govulncheck-action, avoiding the duplicate internal-checkout/Authorization-header failure encountered in the older PR #126 attempt.

Current baseline / expected initial result

A local execution against this exact commit using Go 1.26.2 and govulncheck v1.7.0 completed successfully as a scanner invocation and exited 3 because it found 22 reachable vulnerabilities from 8 modules and the Go standard library.

Per rollout decision, this is a strict hard gate. The initial GitHub check is therefore expected to be red until those findings are remediated; they are not suppressed or converted to advisory output in this PR.

Risks

• All PRs will report a failed govulncheck job while the current reachable findings remain.
• @latest allows scanner updates to change results without a repository commit. This matches the existing Makefile tool declaration and ensures new checks/database behavior are picked up, but reduces tool-version reproducibility.
• The OSV vulnerability database evolves independently, so an unchanged commit may begin failing when a new advisory is published. That is intended for this hard gate.

Rollback strategy

Revert this one-file commit or disable/remove .github/workflows/govulncheck.yml. No chain binary or state rollback is involved.

Migration / upgrade impact

None. This is CI-only:

• no state keys change;
• no CheckTx, DeliverTx, BeginBlock, or EndBlock behavior changes;
• replay and determinism are unaffected;
• no protobuf, keeper, migration, consensus-version, or upgrade-handler changes;
• no IBC or supernode behavior changes.

Observability

GitHub Actions exposes a distinct govulncheck check run and retains the full finding traces in its job log. A nonzero scanner exit is visible as a failed check.

Verification

Executed on immutable commit cc108247c096e56f95953bb9c4140bd8e9252f8b:

• actionlint .github/workflows/govulncheck.yml — PASS
• git diff --check — PASS
• exact workflow scan command — EXECUTED; expected hard-gate exit 3, 22 reachable vulnerabilities
• make unit-tests NOCACHE=1 — PASS
• make integration-tests NOCACHE=1 — PASS
• make test-scripts — PASS (195 tests)
• (cd devnet && go test ./tests/common -count=1) — PASS
• make install plus cmp build/lumerad "$(command -v lumerad)" — PASS
• make system-tests — PASS
• make systemex-tests — PASS (1040.311s)
• make lint — PASS (0 issues)
• final working tree — clean

[mateeullahmalik]

Phase 1 dependency remediation (22 → 5 reachable findings) is #214. The five residual findings that keep this gate RED have no published fixed release and are tracked in #215.