Phase 8: CI/CD workflow updates for Go binaries

Update GitHub Actions workflows to build, test, lint, and publish Go
binaries alongside the existing pipeline.

CI.yml changes:
- Add "go" to the build matrix; gate C# steps with language condition
- Go build steps: setup-go, just go-build, just go-test, golangci-lint
- build-for-e2e-test: replace dotnet publish with Go cross-compilation
  (just go-publish-linux/windows/macos) producing platform binaries
- e2e-test: update binary copy steps to reference Go binary names; keep
  Setup .NET since integration tests are C# projects that invoke binaries
- publish: replace dotnet/publish.ps1 with just go-publish-all; release
  18 flat binaries (3 CLIs x 6 platform/arch combos) instead of zips

Other workflow changes:
- codeql-config.yml: remove disable-default-queries so Go gets CodeQL
  default query suite
- dependabot.yml: add gomod ecosystem for Go dependency updates
- copilot-setup-steps.yml: add Go setup and go mod download

Justfile fixes:
- go-publish-linux: add mkdir -p for dist/linux-arm64 directory
- go-publish-macos: add arm64 builds (darwin-arm64) for all 3 CLIs

Author: offbyone

.github/codeql/codeql-config.yml

@@ -1,5 +1,4 @@
 name: "CodeQL code scanning custom configuration"
-disable-default-queries: true
 queries:
   - name: Use the custom query suite file from this repo
     uses: ./.github/codeql/csharp-custom-queries.qls

.github/dependabot.yml

@@ -10,6 +10,10 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
   - package-ecosystem: "github-actions" # See documentation for possible values
     directory: "/" # Location of package manifests
     schedule:

.github/workflows/CI.yml

@@ -24,7 +24,7 @@ jobs:
       fail-fast: false
       matrix:
         runner-os: [windows-latest, ubuntu-latest, macos-latest]
-        language: [csharp, actions]
+        language: [csharp, go, actions]
 
     runs-on: ${{ matrix.runner-os }}
 
@@ -42,21 +42,27 @@ jobs:
           queries: +security-and-quality
           config-file: ./.github/codeql/codeql-config.yml
 
+      # --- C# steps ---
       - name: Setup .NET
+        if: matrix.language == 'csharp'
         uses: actions/setup-dotnet@v5
         with:
           global-json-file: global.json
 
       - name: dotnet format
+        if: matrix.language == 'csharp'
         run: just format-check
 
       - name: Restore dependencies
+        if: matrix.language == 'csharp'
         run: just restore
 
       - name: Build
+        if: matrix.language == 'csharp'
         run: just build
 
       - name: Unit Test
+        if: matrix.language == 'csharp'
         run: just test-coverage
 
       - name: Copy Coverage To Predictable Location
@@ -89,6 +95,27 @@ jobs:
           name: Code Coverage Report
           path: code-coverage-results.md
 
+      # --- Go steps ---
+      - name: Setup Go
+        if: matrix.language == 'go'
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Go Build
+        if: matrix.language == 'go'
+        run: just go-build
+
+      - name: Go Test
+        if: matrix.language == 'go'
+        run: just go-test
+
+      - name: Go Lint
+        if: matrix.language == 'go'
+        uses: golangci/golangci-lint-action@v8
+        with:
+          version: v2.11.3
+
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4
         if: matrix.runner-os == 'ubuntu-latest'
@@ -123,22 +150,22 @@ jobs:
       # e33e0265a09d6d736e2ee1e0eb685ef1de4669ff is tag v3, pinned to avoid supply chain attacks
       - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b
 
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+      - name: Setup Go
+        uses: actions/setup-go@v5
         with:
-          global-json-file: global.json
+          go-version-file: go.mod
 
       - name: Build Artifacts (Linux)
         if: matrix.target-os == 'ubuntu-latest'
-        run: just publish-linux
+        run: just go-publish-linux
 
       - name: Build Artifacts (Windows)
         if: matrix.target-os == 'windows-latest'
-        run: just publish-windows
+        run: just go-publish-windows
 
       - name: Build Artifacts (MacOS)
         if: matrix.target-os == 'macos-latest'
-        run: just publish-macos
+        run: just go-publish-macos
 
       - name: Upload Binaries
         uses: actions/upload-artifact@v6
@@ -325,14 +352,16 @@ jobs:
             exit 1
           }
 
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+      - name: Setup Go
+        uses: actions/setup-go@v5
         with:
-          global-json-file: global.json
+          go-version-file: go.mod
+
+      # e33e0265a09d6d736e2ee1e0eb685ef1de4669ff is tag v3, pinned to avoid supply chain attacks
+      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b
 
       - name: Build Artifacts
-        run: ./publish.ps1
-        shell: pwsh
+        run: just go-publish-all
         env:
           CLI_VERSION: ${{ github.ref }}
 
@@ -342,18 +371,24 @@ jobs:
         with:
           body_path: ./RELEASENOTES.md
           files: |
-            ./dist/ado2gh.*.win-x64.zip
-            ./dist/ado2gh.*.win-x86.zip
-            ./dist/ado2gh.*.linux-x64.tar.gz
-            ./dist/ado2gh.*.linux-arm64.tar.gz
-            ./dist/ado2gh.*.osx-x64.tar.gz
-            ./dist/ado2gh.*.osx-arm64.tar.gz
             ./dist/win-x64/gei-windows-amd64.exe
             ./dist/win-x86/gei-windows-386.exe
             ./dist/linux-x64/gei-linux-amd64
             ./dist/linux-arm64/gei-linux-arm64
             ./dist/osx-x64/gei-darwin-amd64
             ./dist/osx-arm64/gei-darwin-arm64
+            ./dist/win-x64/ado2gh-windows-amd64.exe
+            ./dist/win-x86/ado2gh-windows-386.exe
+            ./dist/linux-x64/ado2gh-linux-amd64
+            ./dist/linux-arm64/ado2gh-linux-arm64
+            ./dist/osx-x64/ado2gh-darwin-amd64
+            ./dist/osx-arm64/ado2gh-darwin-arm64
+            ./dist/win-x64/bbs2gh-windows-amd64.exe
+            ./dist/win-x86/bbs2gh-windows-386.exe
+            ./dist/linux-x64/bbs2gh-linux-amd64
+            ./dist/linux-arm64/bbs2gh-linux-arm64
+            ./dist/osx-x64/bbs2gh-darwin-amd64
+            ./dist/osx-arm64/bbs2gh-darwin-arm64
 
       - name: Create gh-ado2gh Release
         # a06a81a03ee405af7f2048a818ed3f03bbf83c7b is tag v2, pinned to avoid supply chain attacks

.github/workflows/copilot-setup-steps.yml

@@ -27,3 +27,11 @@ jobs:
 
       - name: Restore dependencies
         run: dotnet restore src/OctoshiftCLI.sln
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Download Go dependencies
+        run: go mod download

justfile

@@ -167,7 +167,7 @@ go-lint:
 
 # Build Go binaries for Linux
 go-publish-linux:
-    mkdir -p dist/linux-x64
+    mkdir -p dist/linux-x64 dist/linux-arm64
     GOOS=linux GOARCH=amd64 go build -o dist/linux-x64/gei-linux-amd64 ./cmd/gei
     GOOS=linux GOARCH=amd64 go build -o dist/linux-x64/ado2gh-linux-amd64 ./cmd/ado2gh
     GOOS=linux GOARCH=amd64 go build -o dist/linux-x64/bbs2gh-linux-amd64 ./cmd/bbs2gh
@@ -187,10 +187,13 @@ go-publish-windows:
 
 # Build Go binaries for macOS
 go-publish-macos:
-    mkdir -p dist/osx-x64
+    mkdir -p dist/osx-x64 dist/osx-arm64
     GOOS=darwin GOARCH=amd64 go build -o dist/osx-x64/gei-darwin-amd64 ./cmd/gei
     GOOS=darwin GOARCH=amd64 go build -o dist/osx-x64/ado2gh-darwin-amd64 ./cmd/ado2gh
     GOOS=darwin GOARCH=amd64 go build -o dist/osx-x64/bbs2gh-darwin-amd64 ./cmd/bbs2gh
+    GOOS=darwin GOARCH=arm64 go build -o dist/osx-arm64/gei-darwin-arm64 ./cmd/gei
+    GOOS=darwin GOARCH=arm64 go build -o dist/osx-arm64/ado2gh-darwin-arm64 ./cmd/ado2gh
+    GOOS=darwin GOARCH=arm64 go build -o dist/osx-arm64/bbs2gh-darwin-arm64 ./cmd/bbs2gh
 
 # Build Go binaries for all platforms
 go-publish-all: go-publish-linux go-publish-windows go-publish-macos
@@ -199,12 +202,22 @@ go-publish-all: go-publish-linux go-publish-windows go-publish-macos
 go-install-extensions-macos: go-publish-macos
     #!/usr/bin/env bash
     set -euo pipefail
+    arch=$(uname -m)
+    if [ "$arch" = "arm64" ]; then
+        dist_dir="osx-arm64"
+        suffix="darwin-arm64"
+    else
+        dist_dir="osx-x64"
+        suffix="darwin-amd64"
+    fi
     for cli in gei ado2gh bbs2gh; do
         dir="gh-${cli}"
         mkdir -p "$dir"
-        cp "./dist/osx-x64/${cli}-darwin-amd64" "./${dir}/gh-${cli}"
+        cp "./dist/${dist_dir}/${cli}-${suffix}" "./${dir}/gh-${cli}"
         chmod +x "./${dir}/gh-${cli}"
-        cd "$dir" && gh extension install . --force && cd ..
+        pushd "$dir" > /dev/null
+        gh extension install . --force || true
+        popd > /dev/null
     done
     echo "Go extensions installed successfully!"