go-ci

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The workflow and Makefile fetch and execute external code at runtime (GitHub Actions and a Go module), namely actions/checkout@v4, actions/setup-go@v5, golangci/golangci-lint-action@v6, and golang.org/x/vuln/cmd/govulncheck@latest, which are downloaded and run during CI.