test: add integration tests for flag/config/env precedence

.github/workflows/ci.yml

@@ -6,10 +6,13 @@ on:
     branches: ['**']
   pull_request:
     branches: [main]
+  # Weekly govulncheck scan catches new vulnerabilities even when the code hasn't changed.
+  schedule:
+    - cron: '0 9 * * 1'  # Every Monday at 9:00 UTC
 
-# Read-only access is sufficient for running tests and linting.
 permissions:
   contents: read
+  issues: write
 
 jobs:
   # Run the full test suite with race detection and generate a coverage report.
@@ -56,7 +59,7 @@ jobs:
       # golangci-lint v2 runs 50+ linters in a single pass.
       # Without a .golangci.yml config file it uses sensible defaults.
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@v7
         with:
           version: v2.10.1
 
@@ -79,6 +82,46 @@ jobs:
 
       # Validate .goreleaser.yml so config errors are caught before tagging a release.
       - name: Verify GoReleaser config
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           args: check
+
+  # Scan dependencies for known vulnerabilities using Go's official scanner.
+  # See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
+  govulncheck:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - uses: golang/govulncheck-action@v1
+        with:
+          go-version-file: go.mod
+
+  # Open a GitHub issue when the scheduled scan finds vulnerabilities.
+  # Only runs on cron failures — PR and push failures are visible in the checks UI.
+  notify:
+    needs: govulncheck
+    runs-on: ubuntu-latest
+    if: failure() && github.event_name == 'schedule'
+    steps:
+      - uses: actions/github-script@v8
+        with:
+          script: |
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: 'govulncheck: vulnerability detected',
+              body: [
+                'The weekly [govulncheck scan](' + context.serverUrl + '/' + context.repo.owner + '/' + context.repo.repo + '/actions/runs/' + context.runId + ') found vulnerabilities.',
+                '',
+                'Review the workflow run and update affected dependencies.'
+              ].join('\n'),
+              labels: ['security']
+            });