chore: import upstream snapshot with attribution

.github/workflows/pr-check.yml

@@ -0,0 +1,153 @@
+name: PR Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+  push:
+    branches:
+      - main
+      - staging
+
+permissions: read-all
+
+jobs:
+
+  lint:
+    name: "Code Quality: Format"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.25'
+          check-latest: true
+
+      - name: Verify formatting
+        run: |
+          if [ -n "$(find . -name "*.go" -not -path "./vendor/*" | xargs gofmt -l)" ]; then
+            echo "Go code is not formatted:"
+            find . -name "*.go" -not -path "./vendor/*" | xargs gofmt -d
+            exit 1
+          fi
+
+  golangci-lint:
+    name: "Code Quality: Lint (${{ matrix.goos }})"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        goos: [linux, darwin, windows, freebsd]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.25'
+          check-latest: true
+
+      # Lint each platform's build tags in turn. Without this, _windows/_darwin/
+      # _freebsd files are skipped under the default GOOS=linux and never analyzed.
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.12.2
+        env:
+          GOOS: ${{ matrix.goos }}
+
+  govulncheck:
+    name: "Security: Vulnerability Scan"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.25'
+          check-latest: true
+
+      - name: Run govulncheck
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
+
+  vendor:
+    name: "Code Quality: Vendor"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.25'
+          check-latest: true
+
+      - name: Verify vendor is in sync
+        run: |
+          go mod vendor
+          git diff --exit-code -- vendor go.mod go.sum
+
+  test:
+    name: "Tests: Unit (${{ matrix.os }})"
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            race: true
+          - os: ubuntu-24.04-arm
+            race: true
+          - os: macos-latest
+            race: true
+          - os: windows-latest
+            race: false
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.25'
+          check-latest: true
+
+      - name: Run tests
+        shell: bash
+        run: |
+          if [ "${{ matrix.race }}" = "true" ]; then
+            go test -race ./...
+          else
+            go test ./...
+          fi
+
+  coverage:
+    name: "Code Quality: Coverage"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.25'
+          check-latest: true
+
+      # Reports total coverage of the linux build; informational, no threshold gate.
+      - name: Measure coverage
+        run: |
+          go test -covermode=atomic -coverprofile=coverage.out ./...
+          go tool cover -func=coverage.out
+          {
+            echo "### Test coverage (linux build)"
+            echo '```'
+            go tool cover -func=coverage.out | tail -1
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/pr-title.yml

@@ -0,0 +1,21 @@
+name: PR Title
+
+# Runs only on pull_request events (never on push), so the semantic-title check
+# always runs for PRs and never shows up as a confusing skipped "(push)" check.
+# It is blocking: a non-conforming title fails the check.
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  semantic-pull-request:
+    name: "Compliance: Check PR Title"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check PR title
+        uses: amannn/action-semantic-pull-request@v6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,48 @@
+# .github/workflows/release.yml
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+# Default to read-only; the release job escalates to contents: write so
+# GoReleaser can create the release and upload assets.
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # Track the latest 1.25.x patch (with check-latest below) so release binaries
+  # pick up stdlib security fixes.
+  GO_VERSION: '1.25'
+  PROJECT_NAME: witr
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: true
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          version: latest
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GORELEASER_CURRENT_TAG: ${{ github.ref_name }}

.github/workflows/smoke-tests.yml

@@ -0,0 +1,64 @@
+name: Smoke Tests
+
+on:
+  pull_request:
+    branches: [ "main", "staging" ]
+
+permissions: read-all
+
+jobs:
+  build-and-test:
+    name: "Build & Test"
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+          - os: linux
+            arch: amd64
+            runner: ubuntu-latest
+          - os: darwin
+            arch: amd64
+            runner: macos-latest
+          - os: windows
+            arch: amd64
+            runner: windows-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.25'
+          check-latest: true
+
+      - name: Build ${{ matrix.os }}/${{ matrix.arch }}
+        shell: bash
+        run: |
+          GOOS=${{ matrix.os }} GOARCH=${{ matrix.arch }} go build -o witr-${{ matrix.os }}-${{ matrix.arch }} ./cmd/witr
+          chmod +x witr-${{ matrix.os }}-${{ matrix.arch }}
+
+      - name: Verify Version
+        shell: bash
+        run: ./witr-${{ matrix.os }}-${{ matrix.arch }} --version
+
+      - name: Verify Help
+        shell: bash
+        run: ./witr-${{ matrix.os }}-${{ matrix.arch }} --help
+
+  test-freebsd:
+    name: "Test: FreeBSD"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Run on FreeBSD
+        uses: vmactions/freebsd-vm@v1
+        with:
+          usesh: true
+          prepare: pkg install -y go
+          run: |
+            go build -o witr-freebsd-amd64 ./cmd/witr
+            chmod +x witr-freebsd-amd64
+            ./witr-freebsd-amd64 --version
+            ./witr-freebsd-amd64 --help
+            go test ./...

.github/workflows/update-docs.yml

@@ -0,0 +1,68 @@
+name: Update Documentation
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+
+
+# Default to read-only; the publishing job escalates to contents: write.
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{github.workflow}}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  GO_VERSION: '1.25'
+  PROJECT_NAME: witr
+
+jobs:
+  update-docs:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: true
+
+      - name: Create man.1 documentation
+        run: |
+          go run internal/tools/docgen/main.go -out ./docs/cli -format man
+
+      - name: Create markdown documentation
+        run: |
+          go run internal/tools/docgen/main.go -out ./docs/cli -format markdown
+
+      - name: Commit and push documentation
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          git add docs/cli
+
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+            exit 0
+          fi
+
+          git commit -m "docs: update CLI documentation"
+
+      - name: Push documentation
+        run: |
+          git push origin ${{ github.ref }}
+
+
+