Rewrite in Go

.claude/CLAUDE.md

@@ -0,0 +1 @@
+@../AGENTS.md

.github/dependabot.yml

@@ -1,16 +1,23 @@
 version: 2
 updates:
-  - package-ecosystem: "cargo"
+  - package-ecosystem: "gomod"
     directory: "/"
     schedule:
       interval: "weekly"
       day: "monday"
       time: "11:00"
       timezone: "America/New_York"
     groups:
-      cargo:
+      go-modules:
         patterns:
           - "*"
+    cooldown:
+      default-days: 10
+      semver-major-days: 7
+      semver-minor-days: 3
+      semver-patch-days: 2
+    commit-message:
+      prefix: "Deps"
 
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -23,3 +30,7 @@ updates:
       github-actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "Deps"

.github/matchers/actionlint.json

@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "actionlint",
+      "pattern": [
+        {
+          "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4,
+          "code": 5
+        }
+      ]
+    }
+  ]
+}

.github/release.yml

@@ -0,0 +1,11 @@
+changelog:
+  exclude:
+    labels:
+      - dependencies
+      - github-actions
+    authors:
+      - dependabot[bot]
+  categories:
+    - title: Changes
+      labels:
+        - "*"

.github/workflows/actions.yml

@@ -0,0 +1,45 @@
+name: Lint GitHub Actions
+
+on:
+  pull_request:
+    branches:
+      - main
+
+    paths:
+      - '.github/workflows/*.yml'
+
+  push:
+    branches:
+      - main
+
+    paths:
+      - '.github/workflows/*.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  actions:
+    name: Check GitHub Actions
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup matchers
+        run: echo "::add-matcher::.github/matchers/actionlint.json"
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      - name: Run actionlint
+        uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          advanced-security: false

.github/workflows/ci.yml

@@ -10,51 +10,124 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 
-env:
-  CARGO_TERM_COLOR: always
+permissions:
+  contents: read
 
 jobs:
-  lint:
-    name: Lint
+  quality:
+    name: Code Quality
     runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Install golangci-lint
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        with:
+          version: v2.11.3
+          args: --help
+
+      - name: Quality - formatting
+        run: make fmt-check
+
+      - name: Quality - go vet
+        run: make vet
+
+      - name: Quality - linting
+        run: make lint
+
+      - name: Quality - go tidy
+        run: make tidy-check
+
+      - name: Regressions - CLI surface changes
+        run: make check-surface
+
+      - name: Regressions - AI skill drift
+        run: make check-skill-drift
+
+  unit-tests:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
-          components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
-      - run: cargo fmt --all -- --check
-      - run: cargo clippy -- -D warnings
+          go-version-file: go.mod
+          cache: true
 
-  test:
-    name: Test
+      - name: Tests - go unit tests
+        run: make test
+
+  integration-tests:
+    name: Integration Tests
     runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-      - run: cargo test
-
-  build:
-    name: Build / ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            artifact: vector
-          - os: macos-latest
-            artifact: vector
-          - os: windows-latest
-            artifact: vector.exe
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Set up Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: '24'
+
+      - name: Install Prism
+        run: npm install -g @stoplight/prism-cli
+
+      - name: Cache BATS
+        id: cache-bats
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        with:
+          path: /usr/local/libexec/bats-core
+          key: bats-1.13.0
+
+      - name: Install BATS
+        if: steps.cache-bats.outputs.cache-hit != 'true'
+        run: |
+          git clone --depth 1 --branch v1.13.0 https://github.com/bats-core/bats-core.git /tmp/bats-core
+          sudo /tmp/bats-core/install.sh /usr/local
+
+      - name: Tests - BATS e2e tests
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: make test-e2e
+
+  security:
+    name: Security
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-      - run: cargo build --release
-      - uses: actions/upload-artifact@v7
-        with:
-          name: vector-${{ matrix.os }}
-          path: target/release/${{ matrix.artifact }}
-          retention-days: 3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Run govulncheck
+        # @latest intentional — pinning delays scanning improvements and
+        # new Go version support for no meaningful reproducibility gain.
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck -tags dev ./...

.github/workflows/release.yml

@@ -6,103 +6,36 @@ on:
       - 'v*'
 
 permissions:
-  actions: write
   contents: write
 
-env:
-  CARGO_TERM_COLOR: always
-
 jobs:
-  build:
-    name: Build / ${{ matrix.target }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-gnu
-            os: ubuntu-latest
-            archive: tar.gz
-          - target: aarch64-unknown-linux-gnu
-            os: ubuntu-latest
-            archive: tar.gz
-          - target: x86_64-apple-darwin
-            os: macos-latest
-            archive: tar.gz
-          - target: aarch64-apple-darwin
-            os: macos-latest
-            archive: tar.gz
-          - target: x86_64-pc-windows-msvc
-            os: windows-latest
-            archive: zip
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Install cross-compilation tools
-        if: matrix.target == 'aarch64-unknown-linux-gnu'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu
-
-      - name: Build
-        run: cargo build --release --target ${{ matrix.target }}
-        env:
-          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
-
-      - name: Package (Unix)
-        if: matrix.os != 'windows-latest'
-        run: |
-          staging="vector-${{ matrix.target }}"
-          mkdir -p "$staging/man/man1"
-          cp target/${{ matrix.target }}/release/vector "$staging/"
-          cp man/man1/vector.1 "$staging/man/man1/"
-          tar czvf "$staging.tar.gz" -C "$staging" .
-          rm -rf "$staging"
-
-      - name: Package (Windows)
-        if: matrix.os == 'windows-latest'
-        run: |
-          cd target/${{ matrix.target }}/release
-          7z a ../../../vector-${{ matrix.target }}.zip vector.exe
-          cd ../../..
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: vector-${{ matrix.target }}
-          path: vector-${{ matrix.target }}.${{ matrix.archive }}
-
   release:
     name: Release
-    needs: build
     runs-on: ubuntu-latest
+    environment: release
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
-      - name: Download artifacts
-        uses: actions/download-artifact@v8
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
-          path: artifacts
-          merge-multiple: true
+          go-version-file: go.mod
+          cache: false
 
-      - name: Create release
-        uses: softprops/action-gh-release@v2
+      - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
-          files: artifacts/*
-          generate_release_notes: true
+          args: release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Update homebrew tap
+      - name: Update Homebrew formula
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
         run: |
           gh workflow run bump-formula.yml \
+            -f version="${GITHUB_REF_NAME}" \
             -f formula=vector \
-            -f version=${GITHUB_REF##refs/tags/} \
-            -f type=rust \
+            -f type=go \
             -R built-fast/homebrew-devtools
-        env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}