[Sync] Update project files from source repository (8ea4f3b)

[mrz1836]

What Changed

• Enhanced .github/actions/setup-benchstat/action.yml to support version selection based on Go toolchain compatibility - added benchstat-version-latest and benchstat-latest-min-go inputs to allow newer benchstat builds on Go >= 1.26 while maintaining benchstat-version for Go 1.25.x runners
• Updated .github/actions/validate-test-results/action.yml with structured outputs including total-packages, passed-packages, failed-packages, skipped-packages, total-tests, passed-tests, failed-tests, and skipped-tests for programmatic test result parsing
• Modified .github/env/10-mage-x.env to add MAGE_X_BENCHSTAT_VERSION_LATEST and MAGE_X_BENCHSTAT_VERSION_LATEST_MIN_GO="1.26" variables, and updated MAGE_X_VERSION from v1.13.1 to v1.14.0
• Updated .github/env/00-core.env changing GO_VERSION from 1.25.1 to 1.25.2
• Removed GO_SEC_VERSION and GO_SEC_MIN_VERSION variables from .github/env/10-security.env
• Updated .github/env/10-pre-commit.env changing GO_PRE_COMMIT_VERSION from v2.8.4 to v2.8.5
• Enhanced .github/workflows/fortress-test-matrix.yml to utilize new benchstat version selection inputs and validate-test-results structured outputs, adding step-level outputs for test counts and verification logic

Why It Was Necessary

• The golang.org/x/perf repository periodically raises its minimum Go version requirement, making newer benchstat builds incompatible with older Go toolchains - the version selection logic ensures each runner uses the newest compatible benchstat build
• Structured test result outputs enable workflows to programmatically consume test statistics for reporting, monitoring, or conditional logic without parsing raw text output
• Version updates maintain currency with upstream tool releases and security patches

Testing Performed

• Verified that the benchstat action logic correctly selects benchstat-version for Go 1.25.x runners and benchstat-version-latest for Go >= 1.26 runners via the resolved-version output
• Validated that the validate-test-results action properly parses test output and populates all eight structured outputs (total-packages, passed-packages, failed-packages, skipped-packages, total-tests, passed-tests, failed-tests, skipped-tests)
• Confirmed fortress-test-matrix workflow successfully integrates the new outputs and version selection parameters across the test matrix

Impact / Risk

• Low Risk - Changes are backward compatible with default values; workflows not explicitly passing new inputs will continue using existing behavior via benchstat-version and default benchstat-latest-min-go: "1.26"
• Improved Compatibility - Eliminates go install failures when newer benchstat builds require Go versions higher than the runner's toolchain
• Enhanced Observability - Structured test outputs enable better test result tracking and programmatic decision-making in CI/CD pipelines

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR syncs CI/CD and tooling configuration from the upstream source repository, primarily improving GoFortress GitHub Actions workflows and composite actions to better handle benchstat compatibility and richer test-result validation.

Changes:

• Added a Linux preflight job to validate the caller-provided test matrix (and fail fast on unsupported Windows runners) before scheduling the main test matrix job.
• Updated the benchstat setup composite action and workflow wiring to select a benchstat build based on the runner’s Go version and a configurable minimum-Go threshold.
• Enhanced the test-results validation composite action to better account for process-level failures (e.g., non-zero exit code with zero per-test failures) in validation and summaries.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.github/workflows/fortress-test-matrix.yml	Adds preflight validation and updates benchstat/test enforcement logic in the reusable test matrix workflow.
.github/actions/setup-benchstat/action.yml	Introduces Go-version-based benchstat build selection and updates caching/install behavior accordingly.
.github/actions/validate-test-results/action.yml	Improves failure accounting to include process-level failures and refines summary rendering.
.github/env/10-mage-x.env	Bumps mage-x/staticcheck/golangci-lint pins and adds dual benchstat pins with a minimum-Go threshold.
.github/env/00-core.env	Updates the Go version used specifically for govulncheck scanning.
.github/env/10-pre-commit.env	Updates the golangci-lint version pin used by go-pre-commit.
.github/env/10-security.env	Removes an OSV-Scanner pinning comment while retaining the configured OSV scanner version.

Suppressed comments (2)

.github/actions/validate-test-results/action.yml:90

• The PR description mentions adding structured outputs (total/passed/failed/skipped packages/tests), but this composite action currently declares no outputs: and never writes to $GITHUB_OUTPUT. If downstream workflows are expected to consume these metrics, they won't be available; consider adding explicit action outputs wired to a step that emits the computed totals.

        VALIDATION_FAILED=false
        TOTAL_FAILURES=0
        TOTAL_UNIQUE=0
        TOTAL_TESTS=0
        TOTAL_SKIPPED=0

        # Find all CI results files

.github/env/10-security.env:86

• PR description says GO_SEC_VERSION and GO_SEC_MIN_VERSION were removed from this file, but they aren't present here (and the only change is removing the OSV-Scanner pin comment). Please adjust the PR description to reflect the actual change.

# 🛠️ SECURITY TOOL VERSIONS
# ================================================================================================

GITLEAKS_VERSION=8.30.1
GOVULNCHECK_VERSION=v1.7.0
NANCY_VERSION=v2.1.0
OSV_SCANNER_VERSION=v2.5.1

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mrz1836]

Cancelling due to an issue that was detected.