Document session learnings in CLAUDE.md

[jonasbn]

Summary

• Notes that go.mod's go 1.25.0 directive is dependency-constrained (fatih/color/golang.org/x/sys require it), not a style choice
• Documents the two previously-undocumented workflows: go-releaser.yml and zizmor.yml (plus zizmor's common fix patterns: artipacked, cache-poisoning, dependabot-cooldown)
• Records main's branch protection rationale (0 required approvals for solo maintainer, required status checks with strict: true)
• Records the Snyk-vs-GitHub-native security tooling decision, so Snyk-sourced CVEs get cross-checked against go.mod/go.sum before being treated as relevant

No code changes — documentation only.

[Copilot]

🟡 Not ready to approve

Newly introduced proper-noun tokens in CLAUDE.md are likely to fail the repo’s Markdown spellcheck CI unless they’re backticked or added to the spellchecker wordlist.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR updates CLAUDE.md (the repository’s contributor/agent guidance) to capture recent operational learnings and clarify constraints that affect maintenance tasks and CI reliability.

Changes:

• Documents why go.mod uses go 1.25.0 (dependency/tidy constraint rather than stylistic preference).
• Expands the GitHub Actions workflow documentation to include go-releaser.yml, zizmor.yml, and branch protection/status-check rationale.
• Adds a “Security Tooling” section recording the Snyk vs. GitHub-native tooling decision and verification guidance.

File summaries

File	Description
CLAUDE.md	Adds maintenance/CI/security-tooling notes intended to prevent future “gotchas” (Go version directive, workflow pinning, branch protection, and security tooling decisions).

Review details

Comments suppressed due to low confidence (2)

CLAUDE.md:128

• Several non-dictionary tokens here (e.g., zizmor/SARIF/artipacked/cache-poisoning/dependabot-cooldown) are not present in .github/spellchecker-wordlist.txt and are likely to trip the Spellcheck Action. Consider rendering these as inline code (or add them to the wordlist in the same PR).

- **zizmor.yml** — static analysis for GitHub Actions workflow security
  (script injection, credential persistence, cache poisoning); uploads SARIF
  to code scanning. Common fixes: `persist-credentials: false` on
  `actions/checkout` (artipacked), `cache: false` on `actions/setup-go` in
  workflows that share a cache with untrusted PR builds (cache-poisoning),

CLAUDE.md:156

• Snyk, CVE, and the plain-text zizmor mention are not in .github/spellchecker-wordlist.txt; this may cause the Spellcheck Action to fail. Either add these words to the wordlist or format them as inline code.

- Snyk was evaluated and dropped (2026-07-30) in favor of GitHub-native
  tooling — Dependabot alerts, secret scanning, and zizmor. If a
  Snyk-sourced CVE is ever cited, verify the affected package actually
  appears in `go.mod`/`go.sum` before treating it as relevant to this repo.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Low

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.