Both checks already passed locally on the current dev tip; wiring them
into the canonical pre-commit gate so security regressions fail fast
instead of leaking into a release.
- 'make vuln' runs govulncheck with reachability analysis against the
Go vuln DB.
- 'make sec' runs semgrep with p/golang + p/security-audit, metrics
off, --error so findings exit non-zero.
Tools must be installed locally (commands in Makefile comments). If
upstream Woodpecker CI runs 'make check', it will need both binaries
on the runner image.
Go 1.26 module (somegit.dev/Owlibou/gnoma), Makefile with
build/test/lint targets, CLAUDE.md with project conventions,
placeholder main.go, and .gitignore.