Initial commit

Author: galt-tr

.cursorrules

@@ -0,0 +1,30 @@
+# Cursor Rules derived from .github/AGENTS.md
+
+## Read AGENTS.md First
+All contributors must read `.github/AGENTS.md` for complete guidelines. If any rule here conflicts with that file, **AGENTS.md** takes precedence.
+
+## Coding Standards
+- Format with `go fmt ./...` and `goimports -w .`.
+- Lint with `golangci-lint run` and vet with `go vet ./...`.
+- Run `go test ./...` before committing.
+- Follow Go naming and commenting conventions described in AGENTS.md.
+
+## Commit Messages
+- Use the format `<type>(<scope>): <imperative short description>`.
+- Types include `feat`, `fix`, `docs`, `test`, `refactor`, `chore`, `build`, `ci`.
+
+## Pull Requests
+- Title format: `[Subsystem] Imperative and concise summary of change`.
+- Description must include the sections:
+  1. **What Changed**
+  2. **Why It Was Necessary**
+  3. **Testing Performed**
+  4. **Impact / Risk**
+
+## Dependency Management
+- Manage modules with `go mod tidy` after import changes.
+- Run `make govulncheck` to check for vulnerabilities when dependencies change.
+
+## Security Reporting
+- Do not open public issues for vulnerabilities.
+- Follow `SECURITY.md` for responsible disclosure.

.devcontainer/devcontainer.json

@@ -0,0 +1,56 @@
+{
+	// Human-readable name that shows up in both VS Code and GoLand
+	"name": "go-template dev container",
+
+	// Official Go 1.24 Bullseye image maintained by the Dev Containers team
+	"image": "mcr.microsoft.com/devcontainers/go:0-1.24-bullseye",
+
+	// Dev Container “features” – extra tooling installed declaratively
+	"features": {
+		// GitHub CLI for release automation / CODEOWNERS triage
+		"ghcr.io/devcontainers/features/github-cli:1": {},
+
+		// golangci-lint (matches your repo's Makefile / CI)
+		"ghcr.io/devcontainers/features/golangci-lint:2": { "version": "2.2.0" },
+
+		// Secure Docker-outside-of-Docker so you can build/publish images from inside the container
+		"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {}
+	},
+
+	// Handy mounts (build cache + host Docker socket)
+	"mounts": [
+		"type=cache,target=/home/vscode/.cache/go-build",
+		"type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock"
+	],
+
+	// Drop all Linux caps and block “sudo bash” style privilege escalation
+	"runArgs": [
+		"--cap-drop=ALL",
+		"--security-opt", "no-new-privileges:true"
+	],
+
+	// Recommended post-create sanity check: vet and full test suite
+	"postCreateCommand": "go vet ./... && go test ./...",
+
+	// IDE-specific tweaks
+	"customizations": {
+		"vscode": {
+			"settings": {
+				"go.useLanguageServer": true,
+				"go.lintTool": "golangci-lint",
+				"go.toolsEnvVars": { "GOFLAGS": "-buildvcs=false" },
+				"editor.formatOnSave": true,
+				"editor.codeActionsOnSave": { "source.organizeImports": true }
+			},
+			"extensions": [
+				"golang.Go",
+				"github.vscode-github-actions",
+				"eamodio.gitlens"
+			]
+		}
+		// GoLand reads the same settings automatically; no extra block needed
+	},
+
+	// Keep using the non-root “vscode” user created by the base image
+	"remoteUser": "vscode"
+}

.dockerignore

@@ -0,0 +1,69 @@
+##
+## Specific to .dockerignore
+##
+
+.git/
+Dockerfile
+contrib/
+
+##
+## Common with .gitignore
+##
+
+# Temporary files
+*~
+*#
+.#*
+
+# Vendors
+node_modules/
+vendor/
+
+# Binaries for programs and plugins
+dist/
+gin-bin
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Byte-compiled / optimized / DLL files
+__pycache__/
+**/__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.Python
+*.py[cod]
+*$py.class
+.pytest_cache/
+..mypy_cache/
+
+# Test binary, build with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Virtual environments
+.venv
+../venv
+.DS_Store
+.AppleDouble
+.LSOverride
+._*
+
+# Custom repo notes
+todo.md
+
+# Temporary directories in the project
+bin
+tmp
+.golangci.yml
+.golangci.json
+.goreleaser.yml
+.editorconfig
+codecov.yml
+LICENSE
+README.md

.editorconfig

@@ -0,0 +1,13 @@
+# EditorConfig helps maintain consistent coding styles
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = tab
+indent_size = 4
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

.gitattributes

@@ -0,0 +1,13 @@
+# Enforce Unix-style line endings for all files
+* text=auto eol=lf
+
+# Go source files
+*.go text
+*.mod text
+*.sum text
+
+# Treat binary files appropriately
+*.png binary
+*.jpg binary
+*.gif binary
+*.svg text

.github/.gitleaks.toml

@@ -0,0 +1,19 @@
+title = "go-template gitleaks config"
+
+[allowlist]
+description = "global allow list"
+files = []
+paths = [
+    '''(?i)\.(?:bmp|gif|jpe?g|png|svg|tiff?)$''',
+    '''(?i)\.(?:eot|[ot]tf|woff2?)$''',
+    '''(?i)\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|dll|pdb|exe|gltf)$''',
+]
+regexes = []
+stopwords = []
+commits = []
+
+[[rules]]
+id = "github-pat"
+description = "GitHub personal access token"
+regex = '''gh[pous]_[0-9A-Za-z]{36,255}'''
+tags = ["github", "token"]