Add Copilot instructions and reorganize GitHub workflows

.github/copilot-instructions.md

@@ -0,0 +1,46 @@
+# Copilot Instructions for toolbox
+
+## Project Overview
+
+- This repository is a personal toolbox that integrates multiple small utilities.
+- Main focus areas are social integrations for Mastodon and Bluesky.
+- Keep changes practical, incremental, and easy to review.
+
+## Coding Guidelines
+
+- Language: Go.
+- Prefer small, focused changes over broad refactors.
+- Preserve existing public behavior unless explicitly asked to change it.
+- Keep source-code comments in English.
+- Follow existing package boundaries and naming style in this repository.
+
+## Validation
+
+- Use Taskfile tasks for local validation.
+- Primary check command:
+
+```sh
+task test
+```
+
+- If needed, run additional checks:
+
+```sh
+task govulncheck
+```
+
+## Dependencies
+
+- Do not add new external dependencies unless there is a clear benefit.
+- If a dependency is added, explain why in the change summary.
+
+## Documentation and Maintenance
+
+- Update related documentation when behavior, options, or workflows change.
+- Keep README and package comments consistent with the current implementation.
+- Prefer explicit notes about assumptions and constraints when they are not obvious from code.
+
+## Current Maintenance Context
+
+- Ongoing maintenance includes workflow cleanup, potential integration with `github.com/goark/webinfo`, and documentation refresh.
+- During this phase, prioritize readability and risk reduction over feature expansion.

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: ci
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test-and-lint:
+    name: lint and test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: latest
+          args: --enable gosec --timeout 3m0s
+
+      - name: Test module
+        run: go test -shuffle on ./...
+
+  govulncheck:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Run govulncheck
+        uses: golang/govulncheck-action@v1
+        with:
+          go-version-file: go.mod
+          go-package: ./...
+          repo-checkout: false

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "0 20 * * 0"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: go
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v3

README.md

@@ -1,7 +1,8 @@
 # [toolbox] -- A collection of miscellaneous commands
 
-[![lint status](https://github.com/goark/toolbox/workflows/lint/badge.svg)](https://github.com/goark/toolbox/actions)
-[![lint status](https://github.com/goark/toolbox/workflows/build/badge.svg)](https://github.com/goark/toolbox/actions)
+[![ci status](https://github.com/goark/toolbox/workflows/ci/badge.svg)](https://github.com/goark/toolbox/actions)
+[![build status](https://github.com/goark/toolbox/workflows/build/badge.svg)](https://github.com/goark/toolbox/actions)
+[![CodeQL status](https://github.com/goark/toolbox/workflows/CodeQL/badge.svg)](https://github.com/goark/toolbox/actions)
 [![GitHub license](https://img.shields.io/badge/license-Apache%202-blue.svg)](https://raw.githubusercontent.com/goark/toolbox/master/LICENSE)
 [![GitHub release](http://img.shields.io/github/release/goark/toolbox.svg)](https://github.com/goark/toolbox/releases/latest)