[qiuyuzhou]

Summary

 .github/
+├── codeql/codeql-config.yml   # security-and-quality query suite
+├── dependabot.yml             # weekly gomod + actions updates, grouped
+└── workflows/
+    ├── test.yml                # Go 1.25/1.26/stable, -race, tidy check, coverage
+    ├── lint.yml                # go vet + golangci-lint
+    └── security.yml            # govulncheck, gosec (SARIF), CodeQL
+.golangci.yml                   # exclusion for 3 legacy unused helpers
+codecov.yml                     # compare against base, not a fixed 80% target
 main.go                         # fix errcheck/staticcheck; drop deprecated import
 transport_test.go               # handle unchecked error returns

Code fixes make golangci-lint pass with default linters, so the lint job is green on day one:

• handle unchecked error returns in transport tests
• remove untrappable os.Kill from signal.Notify
• serial.ToTypedMessage takes the legacy v1 message interface; declare protoiface.MessageV1 (golang/protobuf/proto.Message is its alias — identical type) instead of importing the deprecated golang/protobuf. golang/protobuf becomes an indirect dependency.

Evidence

• Before: golangci-lint run → 18 issues (13 errcheck, 2 staticcheck, 3 unused)
  After: golangci-lint run → 0 issues
• go test -race -shuffle=on -count=1 ./... → ok ... 16s
• go vet ./..., go mod tidy (diff vs committed state), actionlint → all clean

Merge Danger

Door: Two-way

Workflows and lint config are trivially removable. No runtime code path changes — the protoiface.MessageV1 swap is a type-level no-op.

Blast Radius: CI-only

Once branch protection adopts these as required status checks, any red workflow blocks merges. Dependabot starts opening PRs after merge. Coverage upload needs an optional CODECOV_TOKEN secret; without it the workflow still stays green (fail_ci_if_error: false).

CircleCI retirement

The CircleCI build has been red on master since before this branch (last green: #148). This PR removes .circleci/config.yml — its go test / go vet steps are covered by the new workflows; release binaries stay available via build-release.sh.

Note for maintainers: removing the config alone does not stop CircleCI — pipelines now fail with "No configuration was found". To fully silence it, a maintainer with CircleCI access should open Project Settings → Advanced Settings and click Stop Building.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[qiuyuzhou]

@madeye @Mygod — this PR retires CircleCI in favor of the new GitHub Actions workflows (see the PR description for details).

One follow-up needs someone with CircleCI project access: removing .circleci/config.yml does not stop CircleCI — pipelines still trigger on every push and now fail with "No configuration was found", so the red CircleCI check will keep showing on PRs.

Could whoever on the maintainers team has a CircleCI account with admin access to this project please turn it off?

1. Open Project Settings → Advanced Settings
2. Click Stop Building

No other changes are needed on the GitHub side.