Update Copilot release instructions and reorganize workflows

.github/copilot-instructions.md

@@ -33,3 +33,25 @@
 - Group related edits into a single logical commit.
 - Do not include unrelated local changes in the same commit.
 - Use short, descriptive commit messages.
+
+## Release process
+- Create release tags from `master`.
+- Use semantic versioning tags in `vMAJOR.MINOR.PATCH` format.
+- Ensure local repository is clean and synced before tagging.
+
+Release steps:
+
+1. Ensure `master` is up to date.
+2. Create annotated tag:
+  - `git tag -a vX.Y.Z -m "Release vX.Y.Z"`
+3. Push tag:
+  - `git push origin vX.Y.Z`
+4. Create GitHub release with autogenerated notes:
+  - `gh release create vX.Y.Z --generate-notes --title "vX.Y.Z"`
+
+Verification steps:
+
+- Check tag exists:
+  - `git tag -l "vX.Y.Z"`
+- Check release exists:
+  - `gh release view vX.Y.Z --repo goark/pa-api`

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: ci
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test-and-lint:
+    name: lint and test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: latest
+          args: --enable gosec
+
+      - name: Test module
+        run: go test -shuffle on ./...
+
+  govulncheck:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Run govulncheck
+        uses: golang/govulncheck-action@v1
+        with:
+          go-version-file: go.mod
+          go-package: ./...
+          repo-checkout: false

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+  schedule:
+    - cron: "0 20 * * 0"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: go
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v3