AST-162098: Migrate CI/CD from CircleCI to GitHub Actions

.github/workflows/govulncheck.yaml

@@ -0,0 +1,41 @@
+name: Govulncheck
+
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    name: Govulncheck
+    runs-on: cx-public-ubuntu-x64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Config Git credentials for private modules
+        run: git config --global url."https://${GH_TOKEN}@github.com".insteadOf "https://github.com"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GOPRIVATE: github.com/CheckmarxDev/*,github.com/checkmarxDev/*
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@0782b76014f15f24e22a438f30f308df42899ba1 # v1.3.0
+
+      - name: Run govulncheck
+        run: govulncheck ./...
+        env:
+          GOPRIVATE: github.com/CheckmarxDev/*,github.com/checkmarxDev/*
+        continue-on-error: true

.github/workflows/lint.yaml

@@ -0,0 +1,50 @@
+name: Lint
+
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  golangci-lint:
+    name: Lint (golangci-lint)
+    runs-on: cx-public-ubuntu-x64
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for golangci-lint-action to fetch pull requests
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Config Git credentials for private modules
+        run: git config --global url."https://${GH_TOKEN}@github.com".insteadOf "https://github.com"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GOPRIVATE: github.com/CheckmarxDev/*,github.com/checkmarxDev/*
+
+      - name: go mod tidy
+        run: go mod tidy
+        env:
+          GOPRIVATE: github.com/CheckmarxDev/*,github.com/checkmarxDev/*
+
+      - name: Run golangci-lint
+        uses: step-security/golangci-lint-action@1797facf9ea427614d729a4e9cab0fae1a7852d9 # v9.2.0
+        with:
+          version: v2.11.3
+          args: -c .golangci.yml --timeout 10m
+          only-new-issues: true
+        env:
+          GOPRIVATE: github.com/CheckmarxDev/*,github.com/checkmarxDev/*

.github/workflows/pr-linter.yaml

@@ -0,0 +1,27 @@
+name: PR Linter
+
+on:
+  pull_request:
+    types: [opened, edited]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Validate PR Title
+    runs-on: cx-public-ubuntu-x64
+    steps:
+      - name: Check PR Title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          if ! [[ "$PR_TITLE" =~ ^AST-[0-9]+:\ .+ ]]; then
+            echo "::error::PR title must start with a Jira ticket ID in the format 'AST-XXXX: Description'."
+            exit 1
+          fi
+        shell: bash

.gitignore

@@ -18,6 +18,7 @@
 
 !README.md
 !LICENSE
+!CLAUDE.md
 
 !*.yml
 !*.json