ci: Add action 'Capslock Capability Diff'

[dianab-cl]

Add actions

• Capslock Capability Diff
• Dependency Review

[linear-code]

FOU-386

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no outstanding actionable findings.

Summary

This PR adds Capslock capability-diff and dependency-vulnerability CI, introduces supporting classification and reporting scripts, and updates Go toolchains and vulnerable dependencies.

• Compares Capslock output against an exact base revision and blocks only high-signal capability additions.
• Runs GitHub dependency review and govulncheck across all repository Go modules.
• Adds an explained advisory allowlist and maps accepted Go advisories to GitHub advisory identifiers.
• Updates Go to 1.26.6 and refreshes affected dependency graphs.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  PR[Pull request] --> C[Detect Go changes]
  C --> B[Resolve exact base revision]
  B --> D[Generate or restore Capslock baseline]
  D --> X[Compare capabilities]
  X --> H{High-signal additions?}
  H -->|Yes| F[Fail check and publish report]
  H -->|No| P[Publish non-blocking report]
  PR --> A[Resolve accepted advisories]
  A --> G[GitHub dependency review]
  PR --> V[Run govulncheck for each Go module]
  V --> R[Build grouped vulnerability report]
  R --> U{Unexpected reachable advisories?}
  U -->|Yes| F2[Fail check and update PR comment]
  U -->|No| S[Pass check]

Loading

_{Reviews (5) · Last reviewed commit: "After code review"}

[github-actions]

Capslock capability diff: cli

• Base: main (0a310b53322f1c5e872f4357ec8ab26ed97e69e9)
• Baseline: generated from base revision
• New high-signal capabilities (EXEC / NETWORK / FILES / SYSTEM_CALLS / ARBITRARY_EXECUTION / MODIFY_SYSTEM_STATE): 0
• Likely package moves: 0, lower signal: 2, no longer present: 0

Lower signal: 2 capability use(s)

These describe the Capslock analysis more than they describe privilege.

• google.golang.org/grpc/internal/mem gained READ_SYSTEM_STATE
• github.com/moby/sys/user gained UNANALYZED

[dianab-cl]

@greptile review

[dianab-cl]

@greptile review

[dianab-cl]

@greptile review

[dianab-cl]

@greptile review