fix(security): add workflow permissions and update security SLA

[yuanweize]

Summary

• Added explicit permissions: contents: read to .github/workflows/go.yml.
• Updated Action dependencies in go.yml (actions/checkout@v4, actions/setup-go@v5).
• Replaced unrealistic 48-hour SLA in SECURITY.md with practical acknowledgment expectation.

Risk

Low risk — CI workflow permission hardening and documentation realism.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a259edc3-e822-4fde-9d4e-15012c6dfb4f

📥 Commits

Reviewing files that changed from the base of the PR and between 74ec09a and a370d8c.

📒 Files selected for processing (2)

• .github/workflows/go.yml
• SECURITY.md

 _________________________________________
< Schrodinbug: works until I stare at it. >
 -----------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved review issues were identified.

Review effort: Lite
Findings: None

What changed in this PR

This PR hardens CI permissions, updates GitHub Actions dependencies, and revises the security-report acknowledgment policy.

Changes:

• Adds read-only workflow permissions.
• Updates checkout and Go setup actions.
• Replaces the fixed 48-hour security SLA.

File	Description
SECURITY.md	Updates vulnerability-report acknowledgment expectations.
.github/​workflows/​go.yml	Adds least-privilege permissions and newer action versions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.