feat: bump to Go 1.27.1, concurrent collection on all platforms, hardened executor

.github/copilot-instructions.md

@@ -5,7 +5,7 @@ Follows these guidelines precisely to ensure consistency and maintainability of
 
 ## Stack
 
-- Language: Go (Go 1.26+)
+- Language: Go (Go 1.27+)
 - Framework: Go standard library
 - Testing: Go's built-in testing package
 - Dependency Management: Go modules

.github/dependabot.yml

@@ -1,11 +1,42 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+# Dependabot configuration.
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+#
+# The library has no third-party Go dependencies, so the gomod entry mostly
+# guards against one being introduced; the github-actions entry keeps the
+# CI/CD pins current.
 
 version: 2
 updates:
-  - package-ecosystem: "gomod" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  - package-ecosystem: "gomod"
+    directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "Etc/UTC"
+    labels:
+      - "dependencies"
+      - "go"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      go-modules:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "Etc/UTC"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "chore(ci)"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/codeql.yml

@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/pr.yml

@@ -19,10 +19,10 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: ./go.mod
 
@@ -90,10 +90,10 @@ jobs:
       MAKE_DEBUG: true
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: ./go.mod
 

.github/workflows/release.yml

@@ -22,10 +22,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: ./go.mod
 
@@ -38,10 +38,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: ./go.mod
 
@@ -50,7 +50,7 @@ jobs:
           GIT_VERSION=${{ github.ref_name }} GO_OS="linux" make build-dist
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@v4
 
       - name: Sign Linux binaries with Cosign (keyless)
         run: |
@@ -64,7 +64,7 @@ jobs:
           done
 
       - name: Upload Linux distribution files
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: dist-linux
           path: ./dist/
@@ -75,10 +75,10 @@ jobs:
   #   runs-on: windows-latest
   #   steps:
   #     - name: Check out code
-  #       uses: actions/checkout@v6
+  #       uses: actions/checkout@v7
   #
   #     - name: Set up Go
-  #       uses: actions/setup-go@v6
+  #       uses: actions/setup-go@v7
   #       with:
   #         go-version-file: ./go.mod
   #
@@ -159,7 +159,7 @@ jobs:
   #         }
   #
   #     - name: Upload signed Windows artifacts
-  #       uses: actions/upload-artifact@v6
+  #       uses: actions/upload-artifact@v7
   #       with:
   #         name: dist-windows-signed
   #         path: ./dist/assets/
@@ -170,10 +170,10 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: ./go.mod
 
@@ -275,7 +275,7 @@ jobs:
         run: security delete-keychain "$RUNNER_TEMP/build.keychain" || true
 
       - name: Upload macOS pkg artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: dist-macos
           path: ./dist/assets/
@@ -287,27 +287,27 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: ./go.mod
 
       - name: Download Linux distribution files
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: dist-linux
           path: ./dist/
 
       # - name: Download signed Windows artifacts
-      #   uses: actions/download-artifact@v7
+      #   uses: actions/download-artifact@v8
       #   with:
       #     name: dist-windows-signed
       #     path: ./dist/assets/
 
       - name: Download macOS pkg
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: dist-macos
           path: ./dist/assets/
@@ -322,7 +322,7 @@ jobs:
 
       - name: Create GitHub Release
         id: create-github-release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ github.ref_name }}
           name: ${{ github.ref_name }}

.gitignore

@@ -35,4 +35,6 @@ go.work.sum
 /machineid
 .DS_Store
 build/
-dist/
+dist/
+# Local planning notes (not committed)
+.plan/

.golangci.yaml

@@ -80,10 +80,7 @@ linters:
         - (io.Writer).Write
         - io.ReadAll
         - filepath.Match
-        - github.com/spf13/viper.BindPFlag
-        - (*github.com/spf13/cobra.Command).MarkFlagRequired
-        - (*github.com/spf13/pflag.FlagSet).GetString
-        - (*github.com/spf13/pflag.FlagSet).GetInt
-        - (*github.com/spf13/pflag.FlagSet).GetBool
         - encoding/json.Marshal
         - encoding/hex.DecodeString
+        # errors.AsType[T] returns (T, bool); errcheck misreads T as an error result when T implements error.
+        - errors.AsType

CONTRIBUTING.md

@@ -6,10 +6,12 @@ Thank you for your interest in contributing to machineid! This document provides
 
 ### Prerequisites
 
-- Go 1.26 or higher
+- Go 1.27 or higher
 - Git
 - Make
 
+Runnable examples are listed with `go doc -ex github.com/slashdevops/machineid`.
+
 ### Getting Started
 
 1. Fork the repository on GitHub