ci: update workflows to use just recipes

Author: indaco

.github/workflows/ci.yml

@@ -31,13 +31,28 @@ jobs:
       - name: Verify dependencies
         run: go mod verify
 
+      - name: Install just
+        uses: taiki-e/install-action@v2
+        with:
+          tool: just
+
       - name: Install golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
           version: latest
           install-mode: binary
           skip-cache: false
 
+      - name: Install Go tools
+        run: |
+          go install golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize@latest
+
+      - name: Run go modernize
+        run: just modernize
+
+      - name: Run golangci-lint
+        run: just lint
+
   test:
     name: test
     runs-on: ubuntu-latest
@@ -60,5 +75,40 @@ jobs:
       - name: Verify dependencies
         run: go mod verify
 
-      - name: Run tests
-        run: go test -count=1 -timeout 30s $(go list ./... | grep -Ev 'internal/testhelpers|internal/testutils|internal/templates') -covermode=atomic
+      - name: Install just
+        uses: taiki-e/install-action@v2
+        with:
+          tool: just
+
+      - name: Run test
+        run: just test
+
+  test-race:
+    name: test-race
+    runs-on: ubuntu-latest
+    needs: lint
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: go.sum
+          check-latest: true
+
+      - name: Install Go modules
+        run: go mod download
+
+      - name: Verify dependencies
+        run: go mod verify
+
+      - name: Install just
+        uses: taiki-e/install-action@v2
+        with:
+          tool: just
+
+      - name: Run tests with race detector
+        run: just test-race

.github/workflows/coverage.yml

@@ -28,8 +28,13 @@ jobs:
       - name: Verify dependencies
         run: go mod verify
 
-      - name: Run go test
-        run: go test -count=1 -timeout 30s $(go list ./... | grep -Ev 'internal/testhelpers|internal/testutils|internal/templates') -covermode=atomic -coverprofile=coverage.txt
+      - name: Install just
+        uses: taiki-e/install-action@v2
+        with:
+          tool: just
+
+      - name: Run test
+        run: just test-coverage
 
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@v5

.github/workflows/release.yml

@@ -38,12 +38,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: go.sum
           check-latest: true
 
       - name: Run GoReleaser

.github/workflows/security.yml

@@ -0,0 +1,48 @@
+name: security
+
+on:
+  schedule:
+    - cron: '0 6 * * 1' # Every Monday at 6:00 AM UTC
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  GO_VERSION: '1.25'
+
+jobs:
+  govulncheck:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: go.sum
+          check-latest: true
+
+      - name: Install Go modules
+        run: go mod download
+
+      - name: Verify dependencies
+        run: go mod verify
+
+      - name: Install just
+        uses: taiki-e/install-action@v2
+        with:
+          tool: just
+
+      - name: Install govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run govulncheck
+        run: just security-scan