fix(ci): run govulncheck on fixed toolchain

Author: ibetitsmike

.github/workflows/build.yml

@@ -2,9 +2,73 @@ name: build
 on: [push, pull_request]
 
 jobs:
+  govulncheck:
+    runs-on: ubuntu-latest
+    env:
+      GH_PAT: "${{ secrets.PERSONAL_ACCESS_TOKEN }}"
+      GOTOOLCHAIN: local
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      # The reusable charmbracelet/meta govulncheck job always reads go.mod.
+      # Keep the module baseline at Go 1.25.0, but run the scanner with Go 1.26.4
+      # so it uses a fixed standard library.
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: "1.26.4"
+          cache: true
+          check-latest: true
+      - run: |
+          git config --global url."https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/charmbracelet".insteadOf "https://github.com/charmbracelet"
+          git config --global url."https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/charmcli".insteadOf "https://github.com/charmcli"
+        if: env.GH_PAT != ''
+      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - run: go mod tidy
+      - run: govulncheck ./...
+
   build:
-    uses: charmbracelet/meta/.github/workflows/build.yml@main
-    with:
-      go-version: "1.26.4"
-    secrets:
-      gh_pat: "${{ secrets.PERSONAL_ACCESS_TOKEN }}"
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    env:
+      GO111MODULE: "on"
+      GH_PAT: "${{ secrets.PERSONAL_ACCESS_TOKEN }}"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - run: |
+          git config --global url."https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/charmbracelet".insteadOf "https://github.com/charmbracelet"
+          git config --global url."https://${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/charmcli".insteadOf "https://github.com/charmcli"
+        if: env.GH_PAT != ''
+      - name: Install Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Tidy Go modules
+        run: go mod tidy
+      - name: Check for changes
+        run: git diff --exit-code
+      - name: Build
+        run: go build ./...
+      - name: Test
+        run: go test ./...
+
+  dependabot:
+    needs: [build, govulncheck]
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: write
+    if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request' }}
+    steps:
+      - id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --squash --auto "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}