ci: scan notify with supported Go

Keep Go 1.22 for build, vet, and race-test parity on both Ubuntu and
Windows notify jobs. On Ubuntu, run a second actions/setup-go@v5 with
go-version: stable before installing and running govulncheck@v1.3.0,
which requires Go 1.25 or newer and reports 25 reachable standard-library
vulnerabilities fixed only in supported Go releases.

Pin cache-dependency-path to stations/notify/go.sum on every notify
setup-go step so the root-level cache warning clears. Set
persist-credentials: false on the checkout steps in both notify jobs
(CodeRabbit review comment 3630426956).

Windows stays on Go 1.22 without govulncheck.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: solomonneas

.github/workflows/ci.yml

@@ -162,15 +162,23 @@ jobs:
         working-directory: stations/notify
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v5
         with:
           go-version: '1.22'
+          cache-dependency-path: stations/notify/go.sum
       - name: Build
         run: go build ./...
       - name: Vet
         run: go vet ./...
       - name: Test
         run: go test -race ./...
+      - name: Setup stable Go for govulncheck
+        uses: actions/setup-go@v5
+        with:
+          go-version: stable
+          cache-dependency-path: stations/notify/go.sum
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@v1.3.0
       - name: Vulncheck
@@ -186,9 +194,12 @@ jobs:
         working-directory: stations/notify
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v5
         with:
           go-version: '1.22'
+          cache-dependency-path: stations/notify/go.sum
       - name: Build
         run: go build ./...
       - name: Vet

tests/test_ci_workflow.py

@@ -132,8 +132,22 @@ def test_ci_workflow_runs_notify_go_commands_from_notify_directory():
     ubuntu = _workflow_job_section(text, "notify-build-and-test")
     assert "runs-on: ubuntu-latest" in ubuntu
     assert "working-directory: stations/notify" in ubuntu
-    assert "uses: actions/setup-go@v5" in ubuntu
-    assert "go-version: '1.22'" in ubuntu
+    # Two setup-go v5 steps: Go 1.22 for build parity, then stable for the scanner.
+    assert ubuntu.count("uses: actions/setup-go@v5") == 2
+    # Both Go setup steps pin the notify go.sum so the root cache warning clears.
+    assert ubuntu.count("cache-dependency-path: stations/notify/go.sum") == 2
+    # Checkout must not persist credentials (CodeRabbit review comment 3630426956).
+    assert "persist-credentials: false" in ubuntu
+    # Go 1.22 lane runs build, vet, and race tests before the stable scanner lane.
+    go122 = ubuntu.index("go-version: '1.22'")
+    build = ubuntu.index("go build ./...")
+    assert go122 < build
+    race = ubuntu.index("go test -race ./...")
+    # Stable Go lands after the race test and before govulncheck installation.
+    stable = ubuntu.index("go-version: stable")
+    assert race < stable
+    govulncheck_install = ubuntu.index("go install golang.org/x/vuln/cmd/govulncheck@v1.3.0")
+    assert stable < govulncheck_install
     for command in (
         "go build ./...",
         "go vet ./...",
@@ -148,6 +162,8 @@ def test_ci_workflow_runs_notify_go_commands_from_notify_directory():
     assert "working-directory: stations/notify" in windows
     assert "uses: actions/setup-go@v5" in windows
     assert "go-version: '1.22'" in windows
+    assert "persist-credentials: false" in windows
+    assert "cache-dependency-path: stations/notify/go.sum" in windows
     for command in (
         "go build ./...",
         "go vet ./...",