chore(ci-governance): synchronize Go profile

.github/inditextech-ci-sync-manifest.json

@@ -14,7 +14,7 @@
   "creation_year": 2026,
   "integrity": {
     "algorithm": "hmac-sha256",
-    "signature": "8410fa436bc7cc6e8f3ee132677fe7bacd7a4047da096205ab215528b5725b47"
+    "signature": "75a109e95faffe9a8a6f0727192e32d6408c0796dee7212182458102f83d2b74"
   },
   "managed_by": "InditexTech CI governance",
   "managed_paths": {
@@ -30,9 +30,9 @@
     ".github/workflows/code-gomod_go-sonarcloud-analysis.yml": "fcb5c72a4ae59a3b429420b1e15eda5c4c0cb4a0aa89c3f4f99eb2e3198dcaca",
     ".github/workflows/code-release_preview.yml": "5bb379d87f946c3e5cca829b3d3a3071188cc045dd6ebe514732c06662f91181",
     ".github/workflows/codeql.yml": "cdd995b56f89f38fbe2cdfd2701e8e6b1d632710da4d9768e8afdf1225a9454b",
-    ".github/workflows/pr-verify.yml": "f52295fbfe81578c0a6459d8b384be569933ac78d32fff370932a8dec6943e46",
-    ".github/workflows/push-verify.yml": "fd700ba0ee23fdee9cd7ecf23ad386247f4b621b73cc1946f9ef0eda4ea07086",
-    ".github/workflows/scorecard-analysis.yml": "5bd6da647f708cced5d33411cc27aac7f7ee2be06ae541defea677d70fe80481",
+    ".github/workflows/pr-verify.yml": "b39240fd362fb004c3b47cd4189cb527d9e27a7c37645bbe6324d2a757e34f7f",
+    ".github/workflows/push-verify.yml": "49e6e9c6a7015ea59a2bc831982b2fc4bfd1d5721302f6041170b4a15b7d56e1",
+    ".github/workflows/scorecard-analysis.yml": "9866047c5d638ee5d9246e646400cad473ce8ab0f66b444337405b8f9f324f6e",
     "CODE_OF_CONDUCT.md": "ce1e7a8f68a7917d48c03f9f7aae5529367f73af0e959276e889d33ea1e8d4ab",
     "CONTRIBUTING.md": "4e1264ca54a45df44b362c7533f0eba912bfa77b6f561121ae9e5e9d6aa00df3",
     "SECURITY.md": "0ee7a3356bc3a1c7649e3b7a6a9012b0608011be2b1ff8d106ad02c8950bab25",
@@ -47,7 +47,7 @@
   "retained_paths": {},
   "schema_version": 2,
   "source_digests": {
-    "base": "adea55cd4e550d94848b404c36f5678ab4969eacb85004b88e2471c73630947a",
+    "base": "1d8725343c0bf7241b1b2a0a4a5a992240500eb586954a513553a195a02d043d",
     "go": "31367912deed08276e552542d3f117d526d874c4c30206f99c5266ae465aae8e"
   }
 }

.github/workflows/pr-verify.yml

@@ -19,7 +19,6 @@ jobs:
     timeout-minutes: 10
     permissions:
       contents: read
-      checks: write # Lets reviewdog publish actionlint check results.
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -31,7 +30,7 @@ jobs:
       - name: Lint GitHub Actions workflows
         uses: reviewdog/action-actionlint@dbe5299849118fd6f099ba563d263d770955a64a # v1.73.2
         with:
-          reporter: github-pr-check
+          reporter: github-annotations
           fail_level: error
 
   repo-linter:

.github/workflows/push-verify.yml

@@ -22,7 +22,6 @@ jobs:
     timeout-minutes: 10
     permissions:
       contents: read
-      checks: write # Lets reviewdog publish actionlint check results.
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -32,7 +31,7 @@ jobs:
       - name: Lint GitHub Actions workflows
         uses: reviewdog/action-actionlint@dbe5299849118fd6f099ba563d263d770955a64a # v1.73.2
         with:
-          reporter: github-check
+          reporter: github-annotations
           fail_level: error
 
   repo-linter:

.github/workflows/scorecard-analysis.yml

@@ -49,8 +49,29 @@ jobs:
           path: results.sarif
           retention-days: 5
 
+      - name: Resolve code scanning availability
+        id: scanning-availability
+        env:
+          GH_TOKEN: ${{ github.token }}
+          FORCE_ENABLED: ${{ vars.CODE_SCANNING_ENABLED }}
+        run: |
+          set -euo pipefail
+          visibility="$(gh api "/repos/${GITHUB_REPOSITORY}" --jq '.visibility' 2>/dev/null || echo unknown)"
+          seat="$(gh api "/repos/${GITHUB_REPOSITORY}" --jq '.security_and_analysis.advanced_security.status // "unknown"' 2>/dev/null || echo unknown)"
+          enabled=false
+          if [ "${visibility}" = "public" ] || [ "${seat}" = "enabled" ] || [ "${FORCE_ENABLED:-}" = "true" ]; then
+            enabled=true
+          fi
+          echo "Code scanning availability: visibility=${visibility} seat=${seat} enabled=${enabled}"
+          echo "enabled=${enabled}" >> "${GITHUB_OUTPUT}"
+
       - name: Upload SARIF to Code Scanning
+        if: steps.scanning-availability.outputs.enabled == 'true'
         uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           sarif_file: results.sarif
           category: scorecard
+
+      - name: Report unavailable Code Scanning
+        if: steps.scanning-availability.outputs.enabled != 'true'
+        run: echo "::notice::Scorecard SARIF is retained as an artifact; Code Scanning ingestion is unavailable."