fix(ci): unbreak vulncheck, gate go.mod tidiness, upgrade client-go to v3

[sairus2k]

Three independent fixes, one per commit.

1. fix(ci) — govulncheck panic on Go 1.27

vulncheck has failed on every push since bd6730d moved setup-go from 1.26.8 to 1.27.1, which also blocks build (it declares needs: [lint, test, vulncheck]).

It was never reporting a vulnerability — govulncheck itself crashed:

panic: unexpected expr: *ast.KeyValueExpr
  golang.org/x/tools@v0.29.0/go/ssa/builder.go:978
exit status 2

The pin at v1.1.4 vendors x/tools v0.29.0, whose SSA builder cannot handle sources the Go 1.27 toolchain produces. Bumped to v1.8.0 (x/tools v0.50.0).

Only reproducible on linux/amd64 — darwin/arm64 analyses the same tree cleanly, which is why it never showed up locally.

	v1.1.4	v1.8.0
linux/amd64, Go 1.27.1	panic, exit 2	No vulnerabilities found., exit 0

2. ci — fail lint when go.mod is untidy

Renovate cannot rewrite import paths across a Go major version, so #94 left a require that nothing imports. Nothing in CI caught it — lint, test and e2e all passed on a go.mod that go mod tidy reverts.

Added go mod tidy -diff to the lint job. Run against #94's tree it exits 1 and names the dead require exactly. It lives in lint rather than a new job so build gates on it through its existing needs.

3. fix(deps) — client-go v2.64.0 → v3.11.0

Done properly: imports rewritten, so go list -m all resolves a single v3 and go mod tidy is a no-op.

goGitLab.Ptr is deprecated in v3 and carries a //go:fix inline directive, tripping staticcheck SA1019 plus a govet inline diagnostic at all 11 call sites. Ptr's body is exactly return new(v), so substituting new() is behaviour- and type-identical.

Remaining v3.0.0 breaking changes don't reach this code: feature flags and group boards are unused, and only the root package is imported. Every service method this client calls is unchanged between versions. interface.go is untouched — no v3 types leaked into the abstraction seam.

Supersedes #94.

Verification

Run on Go 1.27.1, at every commit:

Gate	Result
go build ./...	exit 0
go vet ./...	exit 0
go test ./...	8/8 packages ok
golangci-lint run --max-same-issues=0 ./...	0 issues
go mod tidy -diff	exit 0
govulncheck ./... (linux/amd64)	exit 0, no vulnerabilities

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	gitlab.com/​gitlab-org/​api/​client-go/​v3@​v3.11.0

View full report