[Sync] Update project files from source repository (bd3c191)

[mrz1836]

What Changed

• The diff provided is empty - no actual code changes are visible in the diff section
• 12 files are listed as changed in the metadata, but their diff content was truncated for brevity
• Cannot describe specific changes without viewing the actual diff content showing removed (-) and added (+) lines

Why It Was Necessary

• Unable to determine the necessity without viewing the actual changes in the diff
• The file list suggests updates to environment configuration, workflow files, and documentation
• Changes appear related to security scanning, CodeQL analysis, and repository conventions based on file names

Testing Performed

• Cannot specify testing details without visibility into the actual code changes
• Verification would depend on the nature of changes in the workflow files and configuration
• CI/CD workflow changes would require validation through GitHub Actions execution

Impact / Risk

• Risk Level: Cannot be assessed without viewing the actual diff content
• Breaking Changes: Unknown - diff content is required to evaluate
• Recommendation: The diff section must contain the actual changed lines to properly evaluate impact and provide accurate PR description

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

This sync PR updates the template’s GitHub workflow and repository “tech conventions” files to align with the upstream source repo, primarily modernizing security scanning by adding OSV-Scanner and updating pinned action/tool versions.

Changes:

• Add OSV-Scanner support to the GoFortress security pipeline (new enable flag, SARIF upload, shared exclusion handling) and disable Nancy by default.
• Update pinned github/codeql-action references and bump CI tool version pins (go-pre-commit, mage-x, osv-scanner, etc.).
• Refresh documentation/tech-conventions to reflect the updated pre-commit installation and dependency scanning approach.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
.github/workflows/scorecard.yml	Bumps upload-sarif action pin for Scorecard SARIF upload.
.github/workflows/fortress.yml	Wires OSV + Guide token secret into reusable security scans workflow and grants security-events: write.
.github/workflows/fortress-setup-config.yml	Adds OSV enablement outputs and includes OSV in security-scan enablement logic/summary.
.github/workflows/fortress-security-scans.yml	Implements OSV-Scanner scanning + SARIF upload; updates Nancy v2 token handling and shared vuln exclusions.
.github/workflows/codeql-analysis.yml	Bumps CodeQL action pins (init, autobuild, analyze).
.github/tech-conventions/pre-commit.md	Updates installation guidance to use verified release binaries + self-update.
.github/tech-conventions/commit-branch-conventions.md	Updates go-pre-commit installation snippet to match new release-binary approach.
.github/env/10-security.env	Introduces shared vuln exclusion list + OSV scanner config/version pins; updates Nancy version.
.github/env/10-pre-commit.env	Bumps go-pre-commit version pin.
.github/env/10-mage-x.env	Bumps mage-x and Nancy pins and adds OSV-Scanner parity pin.
.github/env/00-core.env	Disables Nancy by default and enables OSV scanning by default.
.github/docs/repository-features.md	Updates feature list to include OSV-Scanner and cleans up wording.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.