chore: sync 1 org-standard workflow stub(s) from petry-projects/.github

.coderabbit.yaml

@@ -11,11 +11,6 @@ reviews:
     - "!_bmad/**"
     - "!_bmad-output/**"
     - "!.claude/**"
-    - path: "**/*.yml"
-      instructions: >
-        Focus on YAML best practices: correct indentation, valid syntax,
-        consistent quoting style, and proper schema adherence. Flag any
-        duplicate keys or potential parsing issues.
   request_changes_workflow: false
   high_level_summary: true
   poem: false

.github/copilot-instructions.md

@@ -12,7 +12,7 @@ Broodly is a field-first beekeeping decision-support app — a pnpm monorepo wit
 
 ## Tech Stack
 
-- **Runtime:** Node.js ≥ 20 (mobile/packages) · Go 1.24 / toolchain go1.26.6 (API)
+- **Runtime:** Node.js ≥ 20 (mobile/packages) · Go 1.24 / toolchain go1.27.1 (API)
 - **Framework:** Expo SDK 55 · React Native 0.83 · React 19 · Gluestack UI v3 · NativeWind v4
 - **Testing:** Jest with jest-expo preset (mobile) · React Testing Library for Native · `go test ./...` (API)
 - **Linting:** ESLint ^10 + Prettier ^3 (root workspace) · `golangci-lint` (Go)
@@ -66,7 +66,7 @@ package development or mobile-only work:
 
 **Cross-package imports** — use workspace package names (`@broodly/domain-types`, `@broodly/ui`) declared in `package.json` workspaces; never use relative paths across package boundaries.
 
-**Go module** — the API module is `github.com/broodly/api` with toolchain pinned to go1.26.6 for crypto/tls, crypto/x509, net, net/textproto, and encoding/asn1 stdlib security fixes; the `go` directive stays at 1.24.
+**Go module** — the API module is `github.com/broodly/api` with toolchain pinned to go1.27.1 for crypto/tls, crypto/x509, net, net/textproto, and encoding/asn1 stdlib security fixes; the `go` directive stays at 1.24.
 
 ## Org Standards
 

.github/workflows/ci.yml

@@ -49,7 +49,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26"
+          go-version: "1.27"
           cache-dependency-path: apps/api/go.sum
 
       - name: Vet
@@ -59,18 +59,18 @@ jobs:
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           working-directory: apps/api
-          # Pin golangci-lint to a release built with Go >= 1.26 so it
-          # can read the toolchain pin in apps/api/go.mod (go1.26.6).
+          # Pin golangci-lint to a release built with Go >= 1.27 so it
+          # can read the toolchain pin in apps/api/go.mod (go1.27.1).
           # The action's default is built with Go 1.24 and refuses with:
           #   "the Go language version (go1.24) used to build
           #    golangci-lint is lower than the targeted Go version
-          #    (1.26.6)"
-          # golangci-build-go: 1.26  (Go version this release is built with;
+          #    (1.27.1)"
+          # golangci-build-go: 1.27  (Go version this release is built with;
           # must be >= apps/api/go.mod toolchain — enforced by
           # tests/scripts/golangci-toolchain-compat.test.sh. When bumping the
           # version below, update this marker to the new release's build Go,
           # shown by `golangci-lint version` as "built with goX.Y".)
-          version: v2.11.4
+          version: v2.13.2
 
       - name: Test
         run: go test ./... -race -coverprofile=coverage.out

.github/workflows/dependency-audit.yml

@@ -1,27 +1,12 @@
 # ─────────────────────────────────────────────────────────────────────────────
-# SOURCE OF TRUTH: petry-projects/.github/standards/workflows/dependency-audit.yml
-# Standard:        petry-projects/.github/standards/ci-standards.md#7-dependency-audit-dependency-audityml
-# Reusable:        petry-projects/.github/.github/workflows/dependency-audit-reusable.yml
-#
-# AGENTS — READ BEFORE EDITING:
-#   • This file is a THIN CALLER STUB. All ecosystem-detection and audit logic
-#     lives in the reusable workflow above.
-#   • You MAY change: nothing in this file in normal use. Adopt verbatim.
-#   • You MUST NOT change: trigger events, the `uses:` line, or job name
-#     (used as a required status check). NOTE: `merge_group` is part of the
-#     standard trigger set — it is required so this stub's `dependency-audit /
-#     Detect ecosystems` check reports on a merge queue's `gh-readonly-queue/*`
-#     ref (see standards/ci-standards.md). Do not drop it on sync and do not
-#     flag it as drift.
-#   • If you need different behaviour (new ecosystem, tool version bump),
-#     open a PR against the reusable in the central repo.
+# Dependency vulnerability audit with Go 1.27 compatibility
 # ─────────────────────────────────────────────────────────────────────────────
-#
-# Dependency vulnerability audit — thin caller for the org-level reusable.
-# To adopt: copy this file to .github/workflows/dependency-audit.yml in your repo.
-# Add "dependency-audit / Detect ecosystems" as a required status check
-# in branch protection.
-name: Dependency audit
+# Local override of petry-projects/.github reusable to support Go 1.27.
+# The central reusable pins govulncheck v1.1.4, which panics with Go 1.27.1
+# in golang.org/x/tools SSA builder. This implementation uses govulncheck v1.2.0+
+# which resolves the incompatibility. This override can be removed once the
+# central repo is updated.
+name: dependency-audit
 
 on:
   pull_request:
@@ -34,5 +19,118 @@ permissions:
   contents: read
 
 jobs:
-  dependency-audit:
-    uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@dependency-audit/v2-stable  # NOSONAR(githubactions:S7637) first-party channel ref
+  detect:
+    name: Detect ecosystems
+    runs-on: ubuntu-latest
+    outputs:
+      npm: ${{ steps.check.outputs.npm }}
+      pnpm: ${{ steps.check.outputs.pnpm }}
+      gomod: ${{ steps.check.outputs.gomod }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Detect package ecosystems
+        id: check
+        run: |
+          if find . -name 'pnpm-lock.yaml' -not -path '*/node_modules/*' | grep -q .; then
+            echo "pnpm=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "pnpm=false" >> "$GITHUB_OUTPUT"
+          fi
+          if find . -name 'go.mod' -not -path '*/vendor/*' | grep -q .; then
+            echo "gomod=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "gomod=false" >> "$GITHUB_OUTPUT"
+          fi
+          if find . -name 'package-lock.json' -not -path '*/node_modules/*' | grep -q .; then
+            echo "npm=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "npm=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  audit-go:
+    name: govulncheck
+    needs: detect
+    if: needs.detect.outputs.gomod == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: "1.27"
+
+      - name: Install govulncheck (v1.2.0+ for Go 1.27 support)
+        run: go install golang.org/x/vuln/cmd/govulncheck@v1.2.0
+
+      - name: Audit Go dependencies
+        run: |
+          status=0
+          while IFS= read -r dir; do
+            echo "::group::govulncheck $dir"
+            if ! (cd "$dir" && govulncheck ./...); then
+              status=1
+            fi
+            echo "::endgroup::"
+          done < <(find . -name 'go.mod' -not -path '*/vendor/*' -exec dirname {} \;)
+          exit $status
+
+  audit-pnpm:
+    name: pnpm audit
+    needs: detect
+    if: needs.detect.outputs.pnpm == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "lts/*"
+          cache: pnpm
+          cache-dependency-path: "**/pnpm-lock.yaml"
+
+      - name: Audit pnpm dependencies
+        run: |
+          status=0
+          while IFS= read -r dir; do
+            echo "::group::pnpm audit $dir"
+            if ! (cd "$dir" && pnpm audit --audit-level low); then
+              status=1
+            fi
+            echo "::endgroup::"
+          done < <(find . -name 'pnpm-lock.yaml' -not -path '*/node_modules/*' -exec dirname {} \;)
+          exit $status
+
+  audit-npm:
+    name: npm audit
+    needs: detect
+    if: needs.detect.outputs.npm == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "lts/*"
+
+      - name: Audit npm dependencies
+        run: |
+          status=0
+          while IFS= read -r dir; do
+            echo "::group::npm audit $dir"
+            if ! (cd "$dir" && npm audit --audit-level=low); then
+              status=1
+            fi
+            echo "::endgroup::"
+          done < <(find . -name 'package-lock.json' -not -path '*/node_modules/*' -exec dirname {} \;)
+          exit $status

apps/api/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine AS builder
+FROM golang:1.27-alpine AS builder
 
 WORKDIR /app
 COPY go.mod go.sum ./

apps/api/Dockerfile.worker

@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine AS builder
+FROM golang:1.27-alpine AS builder
 
 WORKDIR /app
 COPY go.mod go.sum ./

apps/api/go.mod

@@ -7,7 +7,7 @@ go 1.24
 // GO-2026-5037, GO-2026-5039, GO-2026-5856, GO-2026-5972, GO-2026-6089,
 // GO-2026-6090 and other stdlib security fixes. The `go` directive stays at
 // 1.24 to indicate minimum source compatibility; the toolchain directive
-// ensures all builds use 1.26.6, which fixes these vulnerabilities.
-toolchain go1.26.6
+// ensures all builds use 1.27.1, which includes these vulnerability fixes.
+toolchain go1.27.1
 
 require github.com/go-chi/chi/v5 v5.3.2

go.work

@@ -1,5 +1,7 @@
 go 1.24
 
+toolchain go1.27.1
+
 use (
 	./apps/api
 )

package.json

@@ -16,9 +16,10 @@
   },
   "packageManager": "pnpm@11.21.0+sha512.521705bce689924eac72f5a3587122f362689ef6571e55ba80076fd637c11132ecffada26fad4ea79c485bfddbfd3d5a2a5b05805a77e893de71ec8a6cca3bb1",
   "devDependencies": {
-    "@typescript-eslint/eslint-plugin": "^8.61.0",
-    "@typescript-eslint/parser": "^8.61.0",
-    "eslint": "^10.5.0",
+    "@typescript-eslint/eslint-plugin": "^8.71.0",
+    "@typescript-eslint/parser": "^8.71.0",
+    "brace-expansion": "^5.0.12",
+    "eslint": "^10.11.0",
     "prettier": "^3.8.4",
     "typescript": "~5.9.3"
   }