ci: add govulncheck, job timeout, dependabot and preserve debug symbols in dev builds

- Add govulncheck step to CI pipeline for vulnerability scanning
- Set 15-minute timeout on CI test job
- Add dependabot config for weekly Go module and GitHub Actions updates
- Split LD_FLAGS so dev builds retain debug symbols while release
  builds remain stripped with -s -w

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -12,6 +12,7 @@ permissions:
 jobs:
   test:
     runs-on: self-hosted
+    timeout-minutes: 15
     container:
       image: golang:1.26.4
     steps:
@@ -23,6 +24,11 @@ jobs:
       - name: Vet
         run: go vet ./...
 
+      - name: Govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+
       - name: Test
         run: go test -v -race -count=1 ./...
 

Makefile

@@ -14,13 +14,15 @@ BUILD_DATE  := $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
 
 VERSION     ?= $(if $(GIT_TAG),$(GIT_TAG),v0.0.0-$(GIT_COMMIT))
 
-LD_FLAGS    := -s -w \
+LD_FLAGS    := \
 	-X main.Version=$(VERSION) \
 	-X main.GitCommit=$(GIT_COMMIT) \
 	-X main.BuildDate=$(BUILD_DATE)
 
+RELEASE_LD_FLAGS := -s -w $(LD_FLAGS)
+
 define BUILD_PLATFORM
-	GOOS=$(1) GOARCH=$(2) CGO_ENABLED=0 $(GO) build -ldflags "$(LD_FLAGS)" \
+	GOOS=$(1) GOARCH=$(2) CGO_ENABLED=0 $(GO) build -ldflags "$(RELEASE_LD_FLAGS)" \
 		-o $(DIST_DIR)/$(BINARY_NAME)-$(1)-$(2)$(3) \
 		./cmd/opencodereview
 endef