Implement M1 scaffolding and OSV ingestion

.env.example

@@ -1,5 +1,7 @@
 # ForkGuard local configuration examples.
 # Do not put secrets in this file.
+FORKGUARD_DB_PATH=~/.forkguard/state.db
+FORKGUARD_CACHE_DIR=~/.forkguard/cache
 GITHUB_TOKEN=
 FORKGUARD_LOG_LEVEL=info
 FORKGUARD_LOG_FORMAT=json

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
   - name: Security vulnerability disclosure
-    url: https://github.com/Ozark-Security-Labs
-    about: Please use GitHub Security Advisories for private vulnerability reports.
+    url: https://github.com/Ozark-Security-Labs/forkguard/security/advisories/new
+    about: Please report vulnerabilities privately using GitHub Security Advisories; see SECURITY.md for details.

.github/dependabot.yml

@@ -11,3 +11,14 @@ updates:
     labels:
       - dependencies
       - github-actions
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:45"
+      timezone: America/Chicago
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - go

.github/pull_request_template.md

@@ -18,4 +18,5 @@ What changed and why?
 
 ## DCO
 
+- [ ] I have read [CONTRIBUTING.md](../CONTRIBUTING.md).
 - [ ] I certify this contribution under the Developer Certificate of Origin and signed off my commits with `git commit -s`.

.github/workflows/ci.yml

@@ -9,13 +9,28 @@ permissions:
   contents: read
 
 jobs:
-  bootstrap:
-    runs-on: ubuntu-24.04
+  go:
+    name: Go (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-14]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Validate bootstrap files
-        run: |
-          test -f README.md
-          test -f LICENSE
-          test -d docs
-          test -f .deterministic-deps.yml
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
+        with:
+          go-version: "1.22.x"
+          cache: true
+      - name: Install golangci-lint
+        run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8
+      - name: Vet
+        run: go vet ./...
+      - name: Lint
+        run: golangci-lint run ./...
+      - name: Test
+        run: go test ./... -race -coverprofile=coverage.out
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: coverage-${{ matrix.os }}
+          path: coverage.out

.github/workflows/codeql.yml

@@ -12,11 +12,15 @@
   security-events: write
 
 jobs:
-  codeql-ready:
+  analyze:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: CodeQL bootstrap placeholder
-        run: |
-          echo "CodeQL analysis will be enabled when implementation source lands."
-          test -f README.md
+      - uses: github/codeql-action/init@fee9466b8957867761f2d78f922ab084e3e2dd17
+        with:
+          languages: go
+      - name: Build
+        run: go build ./...
+      - uses: github/codeql-action/analyze@fee9466b8957867761f2d78f922ab084e3e2dd17
+        with:
+          category: "/language:go"

.github/workflows/security.yml

@@ -17,4 +17,5 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
       - name: Secret pattern smoke check
         run: |
-          ! git grep -nE "(ghp_|github_pat_|sk-[A-Za-z0-9])"
+          pattern='(ghp_|github_pat_|sk-[A-Za-z0-9])'
+          ! git grep -nE "$pattern" -- ':!docs/**' ':!.github/workflows/security.yml'

.gitignore

@@ -12,11 +12,15 @@
 bin/
 dist/
 build/
+/forkguard
 coverage.out
+*.coverprofile
 coverage/
 reports/
 deterministic-deps-report/
 
 # ForkGuard local state
 .forkguard/
 .forkguard-rulegen/
+~/.forkguard/
+~/.forkguard-rulegen/

.golangci.yaml

@@ -0,0 +1,29 @@
+run:
+  timeout: 5m
+
+linters:
+  enable:
+    - errcheck
+    - gosimple
+    - govet
+    - ineffassign
+    - staticcheck
+    - unused
+    - gocritic
+    - gosec
+    - revive
+    - gofmt
+    - goimports
+    - misspell
+    - unconvert
+    - unparam
+  disable:
+    - varnamelen
+    - wsl
+    - lll
+
+issues:
+  exclude-rules:
+    - path: internal/store/gen/.*\.go
+      linters:
+        - gosec

Makefile

@@ -0,0 +1,22 @@
+.PHONY: build generate lint vet test clean
+
+build:
+	go build ./cmd/forkguard
+
+generate:
+	go run github.com/sqlc-dev/sqlc/cmd/sqlc@v1.30.0 generate
+	./scripts/add-go-license-headers.sh internal/store/gen/*.go
+	gofmt -w internal/store/gen/*.go
+
+lint:
+	golangci-lint run ./...
+
+vet:
+	go vet ./...
+
+test:
+	go test ./... -race -coverprofile=coverage.out
+
+clean:
+	rm -f forkguard coverage.out
+	rm -rf bin/ dist/ build/ coverage/ reports/

SECURITY.md

@@ -1,7 +1,36 @@
 # Security Policy
 
-Please report vulnerabilities privately through GitHub Security Advisories for this repository.
+ForkGuard is defensive security software. Please do not report vulnerabilities in public issues until maintainers have investigated and coordinated a fix.
 
-Do not open public issues for vulnerabilities until maintainers have investigated and coordinated a fix. Include a clear description, affected versions or commits, reproduction steps, and any suggested mitigations.
+## Reporting a vulnerability
 
-ForkGuard projects are defensive tools. Do not submit exploit automation, credential theft workflows, or live attack tooling.
+Use GitHub Security Advisories for this repository:
+
+<https://github.com/Ozark-Security-Labs/forkguard/security/advisories/new>
+
+If you cannot use GitHub Security Advisories, contact the maintainers through the Ozark Security Labs GitHub organization and request a private disclosure channel. Do not include exploit details in public discussions.
+
+## Encryption
+
+GitHub Security Advisories provide the preferred private reporting workflow for this project. A standalone project GPG key is not currently published; if encrypted email disclosure is required, request current encryption instructions through the private advisory workflow before sending sensitive details.
+
+## Response targets
+
+Maintainers target the following response times for complete reports:
+
+- Initial acknowledgement: within 3 business days.
+- Triage update: within 10 business days.
+- Coordinated remediation plan: timing depends on severity, affected versions, and downstream coordination needs.
+
+## What to include
+
+Please include:
+
+- A clear description of the issue and security impact.
+- Affected versions, commits, or configuration.
+- Reproduction steps or a minimal proof of concept.
+- Suggested mitigations or patches, if available.
+
+## Scope
+
+ForkGuard projects are defensive tools. Do not submit exploit automation, credential theft workflows, persistence tooling, or live attack tooling.

cmd/forkguard/main.go

@@ -0,0 +1,29 @@
+// Copyright 2026 Ozark Security Labs
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"log/slog"
+	"os"
+
+	"github.com/Ozark-Security-Labs/forkguard/internal/cli"
+)
+
+func main() {
+	if err := cli.Execute(); err != nil {
+		slog.Error(err.Error())
+		os.Exit(1)
+	}
+}

go.mod

@@ -0,0 +1,43 @@
+module github.com/Ozark-Security-Labs/forkguard
+
+go 1.22
+
+require (
+	github.com/golang-migrate/migrate/v4 v4.17.1
+	github.com/spf13/cobra v1.8.1
+	github.com/spf13/pflag v1.0.5
+	github.com/spf13/viper v1.18.2
+	modernc.org/sqlite v1.34.5
+)
+
+require (
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/magiconair/properties v1.8.7 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.1.0 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/sagikazarmark/locafero v0.4.0 // indirect
+	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/spf13/afero v1.11.0 // indirect
+	github.com/spf13/cast v1.6.0 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	go.uber.org/atomic v1.9.0 // indirect
+	go.uber.org/multierr v1.9.0 // indirect
+	golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
+	golang.org/x/sys v0.22.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	modernc.org/libc v1.55.3 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.8.0 // indirect
+)