Bump aquasecurity/trivy-action from a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 to ed142fd0673e97e23eac54620cfb913e5ce36c25

.dockerignore

@@ -0,0 +1,11 @@
+.git
+.github
+.cache
+.gocache
+.gomodcache
+bin
+dist
+output
+*.exe
+*.out
+*.log

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,27 @@
+name: Bug report
+description: Report a defect in defensive behavior, API, UI, or packaging.
+title: "[bug] "
+labels: ["bug"]
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What went wrong?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Reproduction Steps
+      description: Include commands, sample defensive telemetry, and expected vs actual behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: safety
+    attributes:
+      label: Safety Check
+      description: Do not include exploit code, credentials, malware samples, or unauthorized target details.
+    validations:
+      required: true
+

.github/ISSUE_TEMPLATE/collector_request.yml

@@ -0,0 +1,27 @@
+name: Collector request
+description: Request or improve a defensive telemetry collector.
+title: "[collector] "
+labels: ["collector"]
+body:
+  - type: input
+    id: source
+    attributes:
+      label: Telemetry Source
+      placeholder: Sysmon, auditd, Zeek, Suricata, proxy, EDR, SIEM
+    validations:
+      required: true
+  - type: textarea
+    id: sample
+    attributes:
+      label: Redacted Sample
+      description: Provide redacted defensive log samples only. Remove secrets, usernames if sensitive, public IPs if needed, and customer identifiers.
+    validations:
+      required: true
+  - type: textarea
+    id: mapping
+    attributes:
+      label: Desired Mapping
+      description: Which Promtact event fields should this populate?
+    validations:
+      required: false
+

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,30 @@
+name: Feature request
+description: Suggest defensive functionality or operational improvements.
+title: "[feature] "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What defensive workflow or operational gap should this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What should Promtact do?
+    validations:
+      required: true
+  - type: dropdown
+    id: edition
+    attributes:
+      label: Likely Edition
+      options:
+        - Community core
+        - Commercial/enterprise
+        - Unsure
+    validations:
+      required: true
+

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:00"
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - go
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:30"
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions

.github/workflows/ci.yml

@@ -5,13 +5,97 @@ on:
   push:
     branches: [main]
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: promtact
+          POSTGRES_USER: promtact
+          POSTGRES_PASSWORD: promtact
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U promtact -d promtact"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 20
+    env:
+      PROMTACT_TEST_POSTGRES_DSN: postgres://promtact:promtact@localhost:5432/promtact?sslmode=disable
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
-          go-version: "1.24.x"
-      - run: go test ./...
+          go-version: "1.25.12"
+      - run: go mod download
+      - run: go vet ./...
+      - name: Test with race detector
+        run: go test -race ./...
+      - name: Smoke test local startup
+        shell: bash
+        run: |
+          set -euo pipefail
+          log="$(mktemp)"
+          go build -o /tmp/promtact ./cmd/promtact
+          /tmp/promtact --demo --addr 127.0.0.1:0 --insecure >"$log" 2>&1 &
+          pid=$!
+          trap 'kill "$pid" 2>/dev/null || true; wait "$pid" 2>/dev/null || true' EXIT
+          addr=""
+          for _ in $(seq 1 60); do
+            if ! kill -0 "$pid" 2>/dev/null; then
+              echo "server process exited before it became ready" >&2
+              cat "$log"
+              exit 1
+            fi
+            addr="$(grep -Eo 'http://[^[:space:]]+' "$log" | tail -n 1 || true)"
+            if [ -n "$addr" ]; then
+              break
+            fi
+            sleep 1
+          done
+          if [ -z "$addr" ]; then
+            cat "$log"
+            exit 1
+          fi
+          if ! curl --fail --silent "$addr/healthz" >/dev/null; then
+            echo "healthz check failed for $addr" >&2
+            cat "$log"
+            exit 1
+          fi
+          kill "$pid"
+          wait "$pid" || true
+          trap - EXIT
 
+  build:
+    runs-on: ubuntu-latest
+    needs: test
+    strategy:
+      fail-fast: false
+      matrix:
+        goos: [linux, windows]
+        goarch: [amd64, arm64]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version: "1.25.12"
+      - name: Build binaries
+        shell: bash
+        run: |
+          suffix=""
+          if [ "${{ matrix.goos }}" = "windows" ]; then suffix=".exe"; fi
+          mkdir -p dist
+          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} go build -o "dist/promtact-${{ matrix.goos }}-${{ matrix.goarch }}${suffix}" ./cmd/promtact
+          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} go build -o "dist/promtactl-${{ matrix.goos }}-${{ matrix.goarch }}${suffix}" ./cmd/promtactl

.github/workflows/cla.yml

@@ -0,0 +1,51 @@
+name: cla
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+      - labeled
+      - unlabeled
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
+        with:
+          script: |
+            const approvedAssociations = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
+            const association = context.payload.pull_request.author_association;
+            if (approvedAssociations.has(association)) {
+              core.info(`Skipping CLA check for internal contributor (${association}).`);
+              return;
+            }
+
+            // Bots cannot sign a CLA, and their changes carry no copyrightable
+            // contribution to license. Without this, every automated dependency
+            // update would stay permanently red and train us to ignore red PRs.
+            const login = (context.payload.pull_request.user && context.payload.pull_request.user.login) || '';
+            const isBot = context.payload.pull_request.user?.type === 'Bot' || login.endsWith('[bot]');
+            if (isBot) {
+              core.info(`Skipping CLA check for bot account (${login}).`);
+              return;
+            }
+
+            const body = context.payload.pull_request.body || '';
+            const bodyMatches = /-\s*\[x\]\s*I have signed the Promtact CLA/i.test(body);
+            const labels = new Set((context.payload.pull_request.labels || []).map((label) => label.name.toLowerCase()));
+            const labelMatches = labels.has('cla-signed');
+
+            if (bodyMatches || labelMatches) {
+              core.info('CLA check passed.');
+              return;
+            }
+
+            core.setFailed('External contributors must keep the CLA checkbox checked in the PR template or receive the cla-signed label.');

.github/workflows/codeql.yml

@@ -0,0 +1,28 @@
+name: codeql
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "24 3 * * 1"
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze Go
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: go
+      - uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6

.github/workflows/dependency-review.yml

@@ -0,0 +1,18 @@
+name: dependency-review
+
+on:
+  pull_request:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294