Improve project CI — contributor-friendly task list

[yanmxa]

Goal

Harden and modernize our CI. This is a tracking issue split into small, independent tasks — each checkbox is one focused PR, good for first-time contributors.

To claim one: comment below, open a PR, and link it here. Use Conventional Commits + git commit -s (DCO).

Tasks

PR hygiene

• Lint PR titles for Conventional Commits (amannn/action-semantic-pull-request) — good first issue
• Enforce DCO sign-off so unsigned commits are caught — good first issue

Speed & robustness

• Cache Go deps via setup-go cache: true to cut CI time — good first issue
• Add go test -race to catch data races — good first issue
• Adopt golangci-lint to replace the bare go vet step — intermediate

Quality

• Report coverage (-coverprofile → Codecov), and add tests where missing — e.g. internal/app/kit/suggest — intermediate

Security

• Dependabot for the github-actions ecosystem — good first issue
• Pin actions to SHAs (with version comments) — good first issue
• CodeQL scanning for Go — intermediate

Housekeeping

• actions/stale to nudge/close abandoned PRs & issues — good first issue

Current CI

• ci.yml — format check, build, unit + integration tests, go vet. No dependency caching.
• pr-freshness.yml — on push to main, labels/comments open PRs that are superseded or conflicting.

Maintainer-only (not contributor tasks)

• Enable branch protection "Require branches up to date before merging" (or a merge queue) — the primary "stay current" mechanism; pr-freshness only complements it.
• Set Actions → Workflow permissions → "Read and write" so pr-freshness can comment/label.

Got another CI idea? Comment and we'll add it.