updated versions and deps, aded agent instructions (#318)

* updated versions and deps, aded agent instructions

* use go 1.25.7 instead of 1.25.8 since golangci tool chain only goes that for 1.25

* fix coverage test

Author: funkyshu

.claude/CLAUDE.md

@@ -0,0 +1,20 @@
+# VFS Development Standards
+
+All development on this repository MUST follow the comprehensive guidelines documented in `AGENTS.md` at the repository root.
+
+Key requirements include:
+- All new code requires tests with testify/suite
+- Use mockery v3 with EXPECT() pattern (no manual mocks)
+- All PRs must update CHANGELOG.md under [Unreleased]
+- Follow Go version compatibility policy (latest and latest-1 minor versions)
+- Run golangci-lint before committing
+- Use table-driven tests where possible
+- Handle all errors explicitly with wrapped context
+
+See AGENTS.md for complete details on:
+- Testing requirements and coverage thresholds (80% total, 63% package, 52% file)
+- Code quality and style standards
+- CHANGELOG and PR process (including section headings and breaking change rules)
+- Go version policy and upgrade procedures
+- GitHub Actions maintenance (SHA pinning, 10-day rule)
+- Module management for monorepo structure

.cursor/rules

@@ -0,0 +1 @@
+Follow all guidelines in AGENTS.md. This includes testing requirements (testify/suite, mockery v3 EXPECT pattern, table-driven tests, 80% coverage), CHANGELOG updates for all PRs under [Unreleased], Go version policy (support latest and latest-1 minor versions), code quality standards (golangci-lint, explicit error handling, wrapped errors), and PR submission guidelines (use proper section headings, mark breaking changes with "BREAKING CHANGE" text).

.github/workflows/codeql.yml

@@ -67,12 +67,12 @@ jobs:
       # - name: Setup runtime (example)
       #   uses: actions/setup-example@v1
       - name: Setup Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
-          go-version: '1.24' # The Go version to download (if necessary) and use.
+          go-version: '1.25' # The Go version to download (if necessary) and use.
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
+        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -100,6 +100,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
+        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/go-test-coverage.yml

@@ -12,7 +12,9 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version: 1.25
 
       - name: Generate test coverage
         run: go test ./... -coverprofile=./cover.out -covermode=atomic -coverpkg=./...

.github/workflows/go.yml

@@ -35,14 +35,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version: [ 1.24, 1.25 ]
+        go-version: [ 1.25, 1.26 ]
         os: [ ubuntu-latest, macos-latest, windows-latest ]
         module: ${{ fromJson(needs.get_modules.outputs.modules) }}
     runs-on: ${{ matrix.os }}
     name: Test ${{ matrix.module }} (Go ${{ matrix.go-version }}, ${{ matrix.os }})
     steps:
       - name: Install Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: ${{ matrix.go-version }}
           cache: false

.github/workflows/golangci-lint.yml

@@ -45,9 +45,9 @@ jobs:
         module: ${{ fromJSON(needs.detect-modules.outputs.modules) }}
     steps:
       - name: Setup Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
-          go-version: '1.24'
+          go-version: '1.25'
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: golangci-lint

.golangci.yml

@@ -1,6 +1,6 @@
 version: "2"
 run:
-  go: "1.24"
+  go: "1.25"
   issues-exit-code: 1
   tests: true
   allow-parallel-runners: false
@@ -80,7 +80,11 @@ linters:
       min-complexity: 15
     gosec:
       excludes:
-        - G115
+        - G115  # Integer overflow conversion - too many false positives
+        - G117  # Exported field names matching secret patterns (false positives for Options structs)
+        - G101  # Hardcoded credentials detection (false positives in test files with example data)
+        - G703  # Path traversal taint analysis (false positives for legitimate file operations)
+        - G705  # XSS taint analysis (false positives for stdout/stderr output)
     lll:
       line-length: 140
       tab-width: 1

.windsurf/rules/standards.md

@@ -0,0 +1,20 @@
+# VFS Development Standards
+
+All development on this repository MUST follow the comprehensive guidelines documented in `AGENTS.md` at the repository root.
+
+Key requirements include:
+- All new code requires tests with testify/suite
+- Use mockery v3 with EXPECT() pattern (no manual mocks)
+- All PRs must update CHANGELOG.md under [Unreleased]
+- Follow Go version compatibility policy (latest and latest-1 minor versions)
+- Run golangci-lint before committing
+- Use table-driven tests where possible
+- Handle all errors explicitly with wrapped context
+
+See AGENTS.md for complete details on:
+- Testing requirements and coverage thresholds (80% total, 63% package, 52% file)
+- Code quality and style standards
+- CHANGELOG and PR process (including section headings and breaking change rules)
+- Go version policy and upgrade procedures
+- GitHub Actions maintenance (SHA pinning, 10-day rule)
+- Module management for monorepo structure