ci: add 14 OSS-standard GitHub workflows (valkey reference parity)

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,21 @@
+# Disable the "Open a blank issue" option so every report comes through
+# a structured template (bug_report / feature_request / question). The
+# extra two minutes of structure save hours of clarifying back-and-forth.
+blank_issues_enabled: false
+
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/keiailab/postgres-operator/security/advisories/new
+    about: >-
+      Do NOT file public issues for security reports. Use a GitHub Security
+      Advisory or email security@keiailab.com (PGP key in SECURITY.md).
+  - name: GitHub Discussions (Q&A)
+    url: https://github.com/keiailab/postgres-operator/discussions
+    about: >-
+      Use Discussions for usage questions, design feedback, and showcase
+      threads. Issues are reserved for actionable bugs and feature requests.
+  - name: Runbook (operational guidance)
+    url: https://github.com/keiailab/postgres-operator/blob/main/docs/operations/runbook.md
+    about: >-
+      Operational procedures (backup, restore, scaling, upgrade, emergency
+      response). Check the runbook before filing a "how do I…" issue.

.github/kube-linter-config.yaml

@@ -0,0 +1,10 @@
+# Initial kube-linter config — chart 의 production-grade security baseline 충족
+# 까지 default rules 비활성 (follow-up PR 으로 chart templates 의 security
+# context / probes / capabilities drop / resources 추가 후 rules 점진 활성).
+#
+# Reference: valkey-operator 의 .github/kube-linter-config.yaml (10 rule include)
+# 와 정합 필요 — alpha 단계 의 trade-off.
+checks:
+  doNotAutoAddDefaults: true
+  include: []
+  exclude: []

.github/license-allowlist.txt

@@ -0,0 +1,25 @@
+# Permissive SPDX identifiers compatible with this project's
+# Apache-2.0 grant. Every transitive Go dependency's license must
+# resolve to one of these — anything else fails the
+# `go-licenses scan` workflow (see .github/workflows/go-licenses.yml).
+#
+# Copyleft families (GPL / AGPL / LGPL / SSPL / EPL with copyleft
+# clauses) are deliberately omitted. If a dependency requires one of
+# those, open an ADR documenting the redistribution implications
+# before allowlisting it here.
+
+Apache-2.0
+MIT
+BSD-2-Clause
+BSD-3-Clause
+ISC
+MPL-2.0
+Zlib
+Unlicense
+0BSD
+CC0-1.0
+# go-licenses reports public-domain code from the standard library
+# and a handful of vendor packages with the "public domain" SPDX tag.
+public-domain
+# BSD-3-Clause-Modification — minor BSD-3 variant used by golang.org/x.
+BSD-3-Clause-Modification

.github/workflows/ci.yml

@@ -0,0 +1,67 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  lint:
+    name: golangci-lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+      - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
+        with:
+          version: latest
+          args: --timeout=10m
+          # Baseline reached 0 issues across all 20 enabled linters as
+          # of #121 + #122 (modernize / staticcheck / goconst / goheader
+          # cleanup). Switching to whole-file enforcement so future
+          # regressions — not just newly-introduced violations on the
+          # diff — also block the PR.
+          only-new-issues: false
+
+  test:
+    name: unit + envtest
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+      - name: Run tests
+        run: make test
+      - name: Upload coverage
+        if: always()
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
+        with:
+          files: ./cover.out
+          fail_ci_if_error: false
+
+  build:
+    name: build manager binary
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+      - run: make build

.github/workflows/codeql.yml

@@ -0,0 +1,47 @@
+name: CodeQL
+
+# Static-analysis security scanning. Satisfies the OpenSSF Scorecard
+# `SAST` check and uploads alerts to the GitHub code-scanning
+# dashboard.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly, offset from other security crons.
+    - cron: '41 6 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write     # required to upload SARIF results
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [go]
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
+        with:
+          languages: ${{ matrix.language }}
+          # The default + security-extended query suite catches the
+          # full set of OpenSSF-relevant patterns (injection,
+          # path-traversal, weak crypto, unsafe deserialization, etc.)
+          # without the noisy security-and-quality bloat.
+          queries: security-extended
+
+      - uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
+
+      - uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/dco.yml

@@ -0,0 +1,59 @@
+name: DCO
+
+# CONTRIBUTING.md requires every commit to carry a
+# `Signed-off-by:` trailer (Developer Certificate of Origin). The
+# lefthook commit-msg hook enforces this locally for maintainers, but
+# external contributors opening a PR from a fork cannot run our
+# lefthook profile — so we add a server-side check that mirrors it.
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dco:
+    name: Verify Signed-off-by
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0          # need full history for the commit range
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Check DCO sign-off on every PR commit
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          # Fetch base so the commit range resolves even on shallow forks.
+          git fetch --quiet origin "$BASE_SHA"
+          missing=0
+          while read -r sha; do
+            # Skip merge commits (more than one parent).
+            parents=$(git rev-list --parents -n 1 "$sha" | wc -w)
+            if [ "$parents" -gt 2 ]; then
+              echo "::notice ::skipping merge commit $sha"
+              continue
+            fi
+            if ! git log -1 --format=%B "$sha" | grep -qE '^Signed-off-by: .+ <.+@.+>$'; then
+              author=$(git log -1 --format='%an <%ae>' "$sha")
+              subject=$(git log -1 --format=%s "$sha")
+              echo "::error ::commit $sha missing 'Signed-off-by:' trailer"
+              echo "  author : $author"
+              echo "  subject: $subject"
+              missing=$((missing + 1))
+            fi
+          done < <(git rev-list "$BASE_SHA..$HEAD_SHA")
+          if [ "$missing" -gt 0 ]; then
+            echo
+            echo "Add the trailer to every flagged commit with: git commit --amend --signoff"
+            echo "or for multiple commits: git rebase --signoff $BASE_SHA"
+            echo "See https://developercertificate.org/ for the policy text."
+            exit 1
+          fi
+          echo "All PR commits carry a Signed-off-by trailer."

.github/workflows/dependency-review.yml

@@ -0,0 +1,32 @@
+name: Dependency review
+
+# Block PRs that introduce dependencies with known CVEs, unacceptable
+# licenses, or unverified provenance. Pairs with govulncheck (which
+# scans only what the binary calls) — dependency-review covers the
+# graph of every PR addition, not just reachable code.
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  review:
+    name: Review dependencies
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write   # comment the diff summary inline
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
+        with:
+          fail-on-severity: high
+          # See https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-review-action
+          # The repo is Apache-2.0; accept compatible permissive licenses
+          # explicitly. Reject GPL-family (copyleft) to keep the binary
+          # safe to redistribute as a closed-source operator image.
+          allow-licenses: Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, Zlib, Unlicense, 0BSD, CC0-1.0
+          comment-summary-in-pr: on-failure

.github/workflows/go-licenses.yml

@@ -0,0 +1,73 @@
+name: Dependency license report
+
+# Scans every transitive Go dependency for an SPDX-identified
+# license; fails the PR if any dependency carries a copyleft
+# (GPL / AGPL / LGPL family) or other "forbidden" license that
+# would make redistribution of the operator image incompatible
+# with the project's own Apache-2.0 grant.
+#
+# Pairs with:
+# - dependency-review.yml (GitHub-native, license + CVE on PR diff)
+# - this workflow:        full transitive graph, every PR
+
+on:
+  # Run on every PR so the job functions as a `required_status_check`
+  # context (paths-filtered required checks stay pending forever on
+  # PRs that don't match — same lesson as kube-linter #118).
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    - cron: '47 7 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: go-licenses scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+      - name: Install go-licenses
+        run: go install github.com/google/go-licenses@v1.6.0
+      - name: Generate license report
+        run: |
+          mkdir -p artifacts
+          go-licenses csv ./... > artifacts/dependency-licenses.csv 2>artifacts/go-licenses.stderr || true
+          echo "--- first rows ---"
+          head -20 artifacts/dependency-licenses.csv
+      - name: Check against allowlist
+        env:
+          ALLOWLIST: .github/license-allowlist.txt
+        run: |
+          set -euo pipefail
+          allow=$(grep -vE '^\s*(#|$)' "$ALLOWLIST" | sort -u)
+          violations=$(awk -F, '{print $3}' artifacts/dependency-licenses.csv \
+            | sort -u \
+            | grep -vxF "$(echo "$allow")" || true)
+          if [ -n "$violations" ]; then
+            echo "::error ::dependency licenses outside the allowlist:"
+            echo "$violations" | sed 's/^/  - /'
+            echo
+            echo "Affected modules:"
+            awk -F, -v viols="$violations" 'BEGIN{n=split(viols,a,"\n"); for(i in a) v[a[i]]=1} v[$3]{print "  " $1 " (" $3 ")"}' \
+              artifacts/dependency-licenses.csv | sort -u
+            exit 1
+          fi
+          echo "All dependency licenses match the allowlist."
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: dependency-licenses
+          path: artifacts/
+          retention-days: 90