[onedr0p]

Implements the standing note in AGENTS.md's Security section:

• Pins govulncheck in .mise/config.toml via the go backend (go:golang.org/x/vuln/cmd/govulncheck 1.6.0) and adds a vulncheck task running govulncheck ./....
• Runs it in CI as a Go Vulncheck job (same shape and release-please guard as the other Go jobs) wired into the Build Success fan-in, so a new advisory blocks the merge queue.
• Updates AGENTS.md's Security section to describe the wired-up state instead of the "not wired into CI yet" note.

mise run vulncheck passes locally on this repo's current main.

[greptile-apps]

Greptile Summary

The PR pins govulncheck, adds a mise vulnerability-scanning task, runs it as a required CI job, and updates contributor guidance.

• Adds the pinned golang.org/x/vuln/cmd/govulncheck tool and lock entry.
• Adds the vulncheck mise task.
• Adds Go Vulncheck to CI and the Build Success fan-in.
• Documents the new security workflow and updates Go toolchain guidance.

Confidence Score: 4/5

The PR is not yet safe to merge because the required vulnerability-check job cannot complete from a clean checkout without first generating embedded assets.

The previously reported task-prerequisite defect remains at the current head: vulncheck has no dependency on assets, while the isolated CI job checks out the repository and runs that task without generating the files required by the Go package's embed directives.

Files Needing Attention: .mise/config.toml and .github/workflows/ci.yaml

Important Files Changed

Filename	Overview
.mise/config.toml	Pins govulncheck and defines the new vulnerability-scanning task.
.github/workflows/ci.yaml	Adds a read-only vulnerability-check job and makes it a required input to the aggregate build result.
.mise/mise.lock	Records the pinned govulncheck Go backend and version.
AGENTS.md	Documents the wired vulnerability scan and revises Go toolchain version guidance.

_{Reviews (2): Last reviewed commit: "docs(agents): go.mod and mise go version..." | Re-trigger Greptile}

[greptile-apps]

Vulnerability scan skips asset generation

When mise run vulncheck runs in a clean checkout, govulncheck ./... loads packages whose //go:embed inputs are generated and not committed, causing package loading to fail before the vulnerability scan completes.

Suggested change

	[tasks.vulncheck]
	description = "Scan for known vulnerabilities with govulncheck"
	run = "govulncheck ./..."
	[tasks.vulncheck]
	description = "Scan for known vulnerabilities with govulncheck"
	depends = ["assets"]
	run = "govulncheck ./..."