ci: add govulncheck workflow, SHA-pin GitHub Actions, and configure Renovate cooldown - #9789

Changes proposed by this PR

1. Dependency cooldown (.github/renovate.json)

• Set "minimumReleaseAge": "14 days" so Renovate waits 14 days after a release is published before proposing routine updates. Most supply-chain compromises are detected and yanked within hours or days of publication, so a cooldown window prevents automated PRs from immediately picking up a newly compromised release.
• Keeps Renovate's defaults intact: internalChecksFilter defaults to "strict" (delaying PR creation until cooldown passes) and vulnerabilityAlerts defaults to "minimumReleaseAge": null (so known security fixes are still proposed immediately).
• References:
  • From scanner to stealer: inside the Trivy Action supply chain compromise (CrowdStrike)
  • We should all be using dependency cooldowns (William Woodruff)
  • Dependency cooldowns, redux (William Woodruff)
  • Package managers need to cool down (Andrew Nesbitt)

2. GitHub Action hash pinning (.github/renovate.json, .github/workflows/codeql-analysis.yml)

• Enabled "helpers:pinGitHubActionDigests" and added a weekly github-actions package rule in .github/renovate.json so Renovate pins GitHub Actions to full commit SHAs and keeps them updated cleanly.
• Pinned all uses: references in .github/workflows/codeql-analysis.yml (actions/checkout v7.0.1, actions/setup-go v7.0.0, and github/codeql-action/{init,autobuild,analyze} v4.39.3) to full commit SHAs with version comments for Renovate, mitigating mutable tag hijacking such as the trivy-action compromise.

3. govulncheck reachability analysis (.github/workflows/govulncheck.yml)

• Added .github/workflows/govulncheck.yml, running on every push and pull_request targeting master and release/*, as well as on a daily schedule (22 07 * * *).
• govulncheck is Go’s official static analysis tool for vulnerability detection. Unlike traditional scanners that just read your dependency list, govulncheck performs symbol-level reachability analysis to determine if your code actually executes vulnerable functions.
• Proof of value: Running govulncheck against Concourse directly motivated [security] fix(deps): address reachable govulncheck vulnerabilities and bump Go to 1.27.4 #9788, catching reachable Go standard library vulnerabilities (GO-2026-6865, GO-2026-6597, GO-2026-6859), including platform-specific paths such as worker/baggageclaim/volume/stream_in_out_nonlinux.go.
• (shift to the left philosophy) Why a GitHub Action instead of the concourse/ci Trivy scan job in concourse/ci? The Trivy scan-rc-image job only runs on release/* branches (pipelines/release.yml) after building the Linux release-candidate image, is not wired as a blocking passed: gate on create-draft-release / shipit, and only inspects the Linux container image (missing windows and darwin targets). Running govulncheck as a GitHub Action alongside codeql-analysis.yml shifts vulnerability detection left so issues are caught on every PR (including Renovate PRs), on master / release/* pushes, and via daily checks before vulnerable dependencies or Go versions reach release candidates.
• Exact Go version pinning & impact: The workflow pins Go via go-version-file: go.mod with check-latest: false and GOTOOLCHAIN: local. Evaluating with a newer Go toolchain hides standard library CVEs that affect the version declared in go.mod. Impact: when a Go stdlib vulnerability is reported in reachable code, resolve it by bumping the Go patch version in go.mod.
• OS coverage: Runs GOOS=linux govulncheck ./... plus GOOS=windows and GOOS=darwin across ./cmd/concourse, ./fly/..., ./worker/baggageclaim/..., and ./go-archive/... (the cross-platform packages built and tested in Concourse CI, avoiding Linux-only packages such as atc/postgresrunner and worker/runtime that fail to load for non-Linux GOOS).

Notes to reviewer

• Please merge [security] fix(deps): address reachable govulncheck vulnerabilities and bump Go to 1.27.4 #9788 first so govulncheck passes on master when this workflow lands.