chore(ci-governance): adopt Go profile

.gitattributes

@@ -0,0 +1 @@
+hack/tilt/scripts/prepare_values.py linguist-detectable=false

.github/ISSUE_TEMPLATE/1-bug.yml

@@ -0,0 +1,50 @@
+# SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
+# SPDX-License-Identifier: Apache-2.0
+name: Bug Report
+description: Report a reproducible bug
+title: '[Bug] '
+labels: ['bug']
+assignees: []
+
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What's the problem?
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce
+      description: How can we reproduce the bug?
+      placeholder: |
+        1. Go to ...
+        2. Run ...
+        3. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+    validations:
+      required: false
+
+  - type: input
+    id: version
+    attributes:
+      label: Version / Environment
+      placeholder: "e.g. v0.3.2, Node 18, macOS"
+    validations:
+      required: false
+
+  - type: textarea
+    id: notes
+    attributes:
+      label: Additional context or logs
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/2-feature.yml

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
+# SPDX-License-Identifier: Apache-2.0
+name: Feature Request
+description: Suggest a feature or improvement
+title: '[Feature] '
+labels: ['enhancement']
+assignees: []
+
+body:
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Feature description
+      description: What would you like to see added or changed?
+    validations:
+      required: true
+
+  - type: textarea
+    id: motivation
+    attributes:
+      label: Use case or motivation
+      description: Why is this feature useful?
+
+  - type: dropdown
+    id: contribution
+    attributes:
+      label: Would you like to work on this?
+      options:
+        - Yes, I'd like to open a PR
+        - Maybe, I'd need help
+        - No, I'm just proposing it
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/3-other.yml

@@ -0,0 +1,37 @@
+# SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
+# SPDX-License-Identifier: Apache-2.0
+name: Other
+description: Use this for anything that doesn't fit the other templates
+title: '[Other] '
+labels: ['discussion']
+assignees: []
+
+body:
+  - type: textarea
+    id: context
+    attributes:
+      label: Context or topic
+      description: Briefly explain what this is about — question, idea, feedback, etc.
+    validations:
+      required: true
+
+  - type: textarea
+    id: details
+    attributes:
+      label: Details or background
+      description: Add any supporting info, links, logs, or notes that may be useful.
+      placeholder: |
+        Example:
+        - I'm wondering if we should improve X
+        - This tool might be useful for Y
+        - We discussed this in meeting Z
+
+  - type: dropdown
+    id: nextstep
+    attributes:
+      label: What are you hoping to do next?
+      options:
+        - Just opening this for awareness
+        - Looking for input before starting work
+        - Need help or advice
+        - Happy to open a PR based on feedback

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,3 @@
+# SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
+# SPDX-License-Identifier: Apache-2.0
+blank_issues_enabled: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,5 @@
 <!--
-SPDX-FileCopyrightText: 2025 2025 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
-SPDX-FileContributor: enriqueavi@inditex.com
+SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
 
 SPDX-License-Identifier: Apache-2.0
 -->
@@ -19,4 +18,4 @@ Briefly describe the purpose of this PR and what changes it introduces.
 
 ## Additional context
 
-Add any screenshots, test output, or notes for reviewers here.
+Add any screenshots, test output, or notes for reviewers here.

.github/inditextech-ci-go.json

@@ -0,0 +1,7 @@
+{
+  "artifacts": "none",
+  "schema_version": 1,
+  "sonar": true,
+  "verify_command": "make build test lint",
+  "working_directory": "."
+}

.github/inditextech-ci-sync-manifest.json

@@ -0,0 +1,48 @@
+{
+  "configuration": {
+    "development_flow": "trunk-based",
+    "outputs": [],
+    "parameters": {
+      "artifacts": "none",
+      "sonar": true,
+      "verify_command": "make build test lint",
+      "working_directory": "."
+    }
+  },
+  "creation_year": 2026,
+  "integrity": {
+    "algorithm": "hmac-sha256",
+    "signature": "b9e6b75852c23cbbed7265826d4808864092fa5f3c232af9e14f617ae71bf96e"
+  },
+  "managed_by": "InditexTech CI governance",
+  "managed_paths": {
+    ".github/ISSUE_TEMPLATE/1-bug.yml": "cd4dad3f32fe707e06324790a2fe2c25829c55566de2b459d744e785b36e1205",
+    ".github/ISSUE_TEMPLATE/2-feature.yml": "ebb92730d6c01641d055f97ac094cbe07f88fac24be9b689ddf26e47e7bda863",
+    ".github/ISSUE_TEMPLATE/3-other.yml": "5a839b39a98704036210dee498146f51bd5a6c057228685680e02004ff063a9a",
+    ".github/ISSUE_TEMPLATE/config.yml": "10e5dee4d49aa9e7792ceb4c986160c61f95da1ba00a64bf06e5f1f636cd17ec",
+    ".github/PULL_REQUEST_TEMPLATE.md": "23a0b0ac79a9020ccac9c013582a01f86e2df2ae7f914673583b9a3368313041",
+    ".github/inditextech-ci-go.json": "d854041fe302eab86b99a4ee25414027fda743af14f26db7e8883ab90f60c5fd",
+    ".github/workflows/code-gomod_go-PR_verify.yml": "7145f586962f35425afbce4cdd00c61f0447d25f1c22ea48c8131f42343f893e",
+    ".github/workflows/code-gomod_go-sonarcloud-analysis.yml": "65b682f75a2fc0d9e928bc4816d79e1ff6aa68830c47148e23db9943f3a79c10",
+    ".github/workflows/codeql.yml": "a7ff83d8f89a5e02bfd729939a51a0a512a0f2f3fa7ddf9dc688dfdf41937748",
+    ".github/workflows/pr-verify.yml": "f52295fbfe81578c0a6459d8b384be569933ac78d32fff370932a8dec6943e46",
+    ".github/workflows/push-verify.yml": "217097070d0fdef329eae1a7187806a4623d692ce467ca8f1f9a7f56dddb29ed",
+    "repolinter.json": "0efb305c47a63f03c488a34906fc2d5471c84145c2ff553f2aacf3a41b92e1a1"
+  },
+  "managed_variables": {
+    "DEVELOPMENT_FLOW": "trunk-based-development",
+    "WORKING_DIRECTORY": "."
+  },
+  "profile": "go",
+  "repository_id": 1011107741,
+  "retained_paths": {
+    "CODE_OF_CONDUCT.md": "97188ec333ef1e7e4b8811a41e714a922460bf1a07dabf8d9542dd2def6e0af2",
+    "CONTRIBUTING.md": "f9c34489e076248247476a0dc9b7ab07fba014dc2c5d82b9ef246546f6c46dab",
+    "SECURITY.md": "fcaf4cc7669737e9025dafe551a39190dbc3d43b3b5b58e803f5a2a49f39d8f9"
+  },
+  "schema_version": 2,
+  "source_digests": {
+    "base": "09dc9b8d0dcb29288bdb6adeb49cea193b4b79f8de78e55eed00c1c669b5ab5a",
+    "go": "963229e52884cccc1de8b2251ce7745a8fa5e36970553eeb513a9d1f914d4410"
+  }
+}

.github/workflows/code-gomod_go-PR_verify.yml

@@ -0,0 +1,120 @@
+# SPDX-FileCopyrightText: 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)
+# SPDX-License-Identifier: Apache-2.0
+
+name: code-gomod-go-PR-verify
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: code-gomod-go-pr-verify-${{ github.repository }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+env:
+  WORKING_DIRECTORY: ${{ vars.WORKING_DIRECTORY }}
+  # The project-owned verify command travels in the managed component descriptor,
+  # never in an Actions variable: the repo owns its build, governance owns only the
+  # envelope that invokes it.
+  COMPONENT_DESCRIPTOR: .github/inditextech-ci-go.json
+  ASDF_BRANCH_VERSION: '0.18.0'
+
+jobs:
+  verify:
+    name: Code / Verify
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Check out pull request head
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Read governed tool versions
+        id: tool-versions
+        working-directory: ${{ env.WORKING_DIRECTORY }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          resolved=""
+          if [[ -f .tool-versions ]]; then
+            # Validate only real "<plugin> <version>" lines; asdf allows # comments (SPDX/REUSE) and blank lines.
+            if grep -vE '^[[:space:]]*(#|$)' .tool-versions | grep -qvE '^[a-zA-Z0-9_-]+ [a-zA-Z0-9._+-]+$'; then
+              echo "::error title=Invalid tool-versions::${WORKING_DIRECTORY}/.tool-versions is malformed."
+              exit 1
+            fi
+            # Emit only the governed golang pin so asdf ignores project extra pins (e.g. kind).
+            resolved="$(grep -E '^golang ' .tool-versions || true)"
+          fi
+          if [[ -z "$resolved" ]]; then
+            # No committed golang pin: derive it from the module's own go directive so the
+            # governed lane follows the product's declared toolchain instead of failing or
+            # clamping it. A committed pin always wins over the derived one.
+            if [[ ! -f go.mod ]]; then
+              echo "::error title=Missing go toolchain::${WORKING_DIRECTORY} has no golang pin in .tool-versions and no go.mod to derive one from."
+              exit 1
+            fi
+            version="$(sed -nE 's/^toolchain[[:space:]]+go([0-9]+\.[0-9]+(\.[0-9]+)?)[[:space:]]*$/\1/p' go.mod | head -n 1)"
+            if [[ -z "$version" ]]; then
+              version="$(sed -nE 's/^go[[:space:]]+([0-9]+\.[0-9]+(\.[0-9]+)?)[[:space:]]*$/\1/p' go.mod | head -n 1)"
+            fi
+            if [[ -z "$version" ]]; then
+              echo "::error title=Missing go toolchain::${WORKING_DIRECTORY}/go.mod declares no usable go version."
+              exit 1
+            fi
+            # asdf installs an exact patch release; a two-part directive (go 1.21) means .0.
+            if [[ "$version" != *.*.* ]]; then
+              version="${version}.0"
+            fi
+            resolved="golang ${version}"
+            echo "::notice title=Derived go toolchain::Using ${resolved} from ${WORKING_DIRECTORY}/go.mod."
+          fi
+          {
+            echo "tool_versions<<EOF"
+            echo "$resolved"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Set up asdf-managed Go
+        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4.0.1
+        with:
+          tool_versions: ${{ steps.tool-versions.outputs.tool_versions }}
+          asdf_version: ${{ env.ASDF_BRANCH_VERSION }}
+
+      - name: Resolve governed verify command
+        id: descriptor
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ ! -f "$COMPONENT_DESCRIPTOR" ]]; then
+            echo "::error title=Missing descriptor::${COMPONENT_DESCRIPTOR} not found."
+            exit 1
+          fi
+          # The descriptor is governance-owned and schema-validated; verify_command
+          # always resolves, but fail closed if it is somehow blank.
+          verify_command="$(jq -er '.verify_command // "make verify"' "$COMPONENT_DESCRIPTOR")"
+          if [[ -z "$verify_command" ]]; then
+            echo "::error title=Empty verify command::descriptor verify_command must not be blank."
+            exit 1
+          fi
+          {
+            echo "verify_command<<EOF"
+            echo "$verify_command"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Verify and test
+        working-directory: ${{ env.WORKING_DIRECTORY }}
+        shell: bash
+        env:
+          VERIFY_COMMAND: ${{ steps.descriptor.outputs.verify_command }}
+        run: |
+          set -euo pipefail
+          # The project owns its build; governance only invokes the governed
+          # verify_command inside the pinned working directory.
+          bash -c "$VERIFY_COMMAND"