feat(ci): adopt go-install-hardened workflow (Shai-Hulud defense)

SR
3mo ago
+23-0

Adopts the go-install-hardened.yml reusable workflow + pins Go env vars in go.env for module-integrity safety. Extends the Shai-Hulud supply-chain defense (currently rolled out for npm/PyPI) to Go.\n\n- Reusable workflow: allora-network/ci-workflows-private#17 (SHA-pinned to fa8a0e1361216ec0c75e4d822f648248083e229b; will re-pin to @v1 after merge)\n- Skill: allora-network/skills#69\n- Linear umbrella: "Adopt go-install-hardened.yml across all 11 active Go repos"\n- cgo_enabled: '0'\n\n🤖 Generated with Claude Code

Summary by cubic

Adopts a hardened Go install workflow and pins Go module integrity to strengthen the supply chain (Shai-Hulud defense). Aligns with the Linear rollout across Go repos.

  • New Features
    • Adds .github/workflows/go-hardened.yml reusing go-install-hardened.yml from allora-network/ci-workflows-private, pinned to the v1 head, with go_version: stable and cgo_enabled: '0'.
    • Adds go.env with GOPROXY=https://proxy.golang.org,direct, GOSUMDB=sum.golang.org, and GOFLAGS=-mod=readonly.