feat(tests): more tests and ci action (#14)

* feat(tests): more tests and ci action
* fix(ci): coverage and pr-lint
* fix(ci): renovate rules, permissions, linting, actions
* fix(lint): editorconfig fixes
* fix(lint): kics.config
* fix(lint): formatting, permissions, pre-commit config
* chore(ci): set workflow to use go 1.23, go mod tidy
* chore(ci): fixes and stuff
* chore(ci): disable GO_GOLANGCI_LINT
* chore(ci): pinning, permissions

.github/workflows/ci.yml

@@ -2,13 +2,14 @@
 # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: Build and Publish
 
+# yamllint disable-line rule:truthy
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
   release:
-    types: [ created ]
+    types: [created]
 
 permissions: read-all
 
@@ -16,17 +17,30 @@ jobs:
   build:
     name: Build Binaries
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      packages: write
+      actions: write
+
     strategy:
       matrix:
-        goos: [ "linux", "darwin" ]
+        goos: ["linux", "darwin"]
+
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Go
-        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
-          go-version: '1.24'
+          go-version-file: "./go.mod"
+
+      - name: Run go mod tidy
+        shell: bash
+        run: go mod tidy
 
       - name: Build binary for ${{ matrix.goos }}
         shell: bash
@@ -37,22 +51,27 @@ jobs:
             .
 
       - name: Upload artifact for ${{ matrix.goos }}
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         with:
           name: gibidify-${{ matrix.goos }}
           path: gibidify-${{ matrix.goos }}
 
   docker:
     name: Build and Publish Docker Image
+    if: github.event_name == 'release'
     needs: build
     runs-on: ubuntu-latest
-    if: github.event_name == 'release'
+
+    permissions:
+      packages: write
+      actions: write
+
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Download Linux binary artifact
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: gibidify-linux
           path: .