chore(ci): supply-chain security workflow + harden ci.yml #6

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	# Default-deny at workflow level; jobs grant only what they need.
	permissions: {}

	jobs:
	markdown-lint:
	name: markdown lint
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
	- uses: DavidAnson/markdownlint-cli2-action@b4c9feab76d8025d1e83c653fa3990936df0e6c8 # v16.0.0
	with:
	globs: '*/.md'

	go:
	name: go vet + test
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
	- id: detect
	name: detect go module
	run: \|
	if [ -f go.mod ]; then
	echo "has_go=true" >> "$GITHUB_OUTPUT"
	else
	echo "has_go=false" >> "$GITHUB_OUTPUT"
	echo "::notice::No go.mod present; skipping go vet and go test."
	fi
	- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
	if: steps.detect.outputs.has_go == 'true'
	with:
	go-version-file: go.mod
	cache: true
	- name: go vet
	if: steps.detect.outputs.has_go == 'true'
	run: go vet ./...
	- name: go test
	if: steps.detect.outputs.has_go == 'true'
	run: go test ./...

Provide feedback