popertotsandSisyphus fba00a10ad ci: pin go install tool versions (gitleaks/golangci-lint/staticcheck/gosec/govulncheck), env-docs check covers getEnv reads, ignore .sisyphus session artifacts ...

- ci.yaml: no more @latest — pinned to released versions; supply-chain audit clean (govulncheck gates CI, npm audit gate, lockfiles committed, npm ci)
- check-env-docs.py: detects env vars read via the getEnv() helper (R2_* blind spot closed); 42 vars documented
- .gitignore: .sisyphus/ review reports

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

2026-08-22 00:34:51 +01:00

..

workflows

ci: pin go install tool versions (gitleaks/golangci-lint/staticcheck/gosec/govulncheck), env-docs check covers getEnv reads, ignore .sisyphus session artifacts

2026-08-22 00:34:51 +01:00