feat(auth): move browser login to RFC 8628 device flow on www.vulnetix.com

`vulnetix auth login` no longer talks to app.vulnetix.com. The flow is now a
proper device authorization grant served by www.vulnetix.com.

The old scheme was not a device flow. The CLI invented the six-character code
and polled a public endpoint that handed the org ApiKey to whoever presented an
unclaimed code inside the five-minute TTL. Nothing bound the CLI that created
the code to the client that collected the key; guessing the 36^6 space was the
only barrier. The endpoints were also hardcoded constants, so the flow could
not be pointed at a test server and had no test coverage at all.

Now:
- The CLI POSTs /cli/device/authorize before opening a browser and receives a
  256-bit device_code plus a short user_code. The device_code is the credential
  and is never printed; the user_code is only an approval handle.
- Polling /cli/device/token honours the server's interval and expires_in, and
  handles authorization_pending, slow_down (backs off), expired_token and
  access_denied. A 429 from the rate limiter also backs off.
- The browser is opened at verification_uri_complete, so the code is pre-filled
  and the user confirms rather than transcribes.
- VULNETIX_WEB_URL overrides the console base for local verification, mirroring
  VULNETIX_API_URL. `--verbose` prints the resolved endpoints.

Adds cmd/auth_device_test.go — the first test coverage of this code — driving
the whole client state machine against an httptest server, and
scripts/verify-device-flow.sh, which stands up website + vdb-site + Postgres
locally and asserts the proxy path, the JWT gate, the rate limiter, the pending
state, single-use redemption, and that only the sha256 of the device_code is
persisted.

Docs: every `--base-url https://app.vulnetix.com/api` example was wrong. The
CLI has never contacted that host. Uploads and `gha` go to
api.vdb.vulnetix.com/v1, `vdb`/`package-firewall` to api.vdb.vulnetix.com, and
`/api/check` never existed — the reachable probe is /health. The corporate
proxy guide now names all three hosts an allowlist must carry.

Lint: golangci-lint is clean uncapped. Removes seven dead functions, fixes four
ineffectual assignments (one in the login path), two S1017 TrimPrefix cases, an
empty branch and a dead append, and checks the errors that errcheck flagged.
Adds a lint job to CI with a pinned linter version, and a pre-commit hook
(`just hooks`).

Author: 0x73746F66

.githooks/pre-commit

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+#
+# Fast local feedback before a commit. GitHub Actions is the authority; this
+# hook exists so you find out in two seconds rather than two minutes.
+#
+# Enable once per clone:  just hooks
+# Bypass in an emergency: git commit --no-verify
+#
+# Only staged Go files are considered, so the cost scales with the diff.
+
+set -uo pipefail
+
+staged_go() { git diff --cached --name-only --diff-filter=ACMR -- '*.go'; }
+
+mapfile -t GO_FILES < <(staged_go)
+[[ ${#GO_FILES[@]} -eq 0 ]] && exit 0
+
+fail=0
+
+# --- gofmt -----------------------------------------------------------------
+unformatted=$(gofmt -l "${GO_FILES[@]}" 2>/dev/null)
+if [[ -n "${unformatted}" ]]; then
+    echo "pre-commit: these files are not gofmt'd:" >&2
+    printf '  %s\n' ${unformatted} >&2
+    echo "  fix: gofmt -w ${unformatted}" >&2
+    fail=1
+fi
+
+# --- go vet, scoped to the packages that changed ----------------------------
+mapfile -t PKGS < <(printf '%s\n' "${GO_FILES[@]}" | xargs -r -n1 dirname | sort -u | sed 's#^#./#')
+if [[ ${#PKGS[@]} -gt 0 ]]; then
+    if ! go vet "${PKGS[@]}" 2>&1; then
+        echo "pre-commit: go vet failed" >&2
+        fail=1
+    fi
+fi
+
+# --- golangci-lint, when available -----------------------------------------
+# A missing linter must not block a commit; CI still enforces it.
+if command -v golangci-lint >/dev/null 2>&1; then
+    if ! golangci-lint run "${PKGS[@]}" 2>&1; then
+        echo "pre-commit: golangci-lint found issues" >&2
+        fail=1
+    fi
+else
+    echo "pre-commit: golangci-lint not installed, skipping (CI will run it)" >&2
+fi
+
+if [[ ${fail} -ne 0 ]]; then
+    echo >&2
+    echo "pre-commit failed. Fix the above, or commit with --no-verify to bypass." >&2
+    exit 1
+fi

.github/workflows/docs.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.21"
+          go-version-file: go.mod
 
       - name: Build Hugo site
         working-directory: website

.github/workflows/release.yml

@@ -14,6 +14,12 @@ on:
 permissions:
   contents: write
 
+# Never run two releases for the same version at once: the create-or-update
+# step is idempotent but not concurrency-safe against itself.
+concurrency:
+  group: release-${{ inputs.version || github.ref }}
+  cancel-in-progress: false
+
 env:
   # Force JS actions to Node 24 so deprecated Node 20 runs stop firing while
   # action versions catch up (silences upload-artifact@v5 et al.).
@@ -22,6 +28,7 @@ env:
 jobs:
   version:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       version: ${{ steps.version.outputs.VERSION }}
     steps:
@@ -40,13 +47,14 @@ jobs:
     # Linux + Windows targets are cross-compiled from ubuntu using zig cc.
     needs: version
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
 
       - name: Configure vdb-sca-match private fetch (not yet in module proxy)
         run: |
@@ -99,13 +107,14 @@ jobs:
     # CGO (zig cc can't target macOS without the SDK).
     needs: version
     runs-on: macos-latest
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version-file: go.mod
 
       - name: Configure vdb-sca-match private fetch (not yet in module proxy)
         run: |
@@ -137,6 +146,7 @@ jobs:
   release:
     needs: [version, build-cross, build-darwin]
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     outputs:
       version: ${{ needs.version.outputs.version }}
     steps:
@@ -180,7 +190,11 @@ jobs:
   test-go-install:
     needs: release
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
+      # This job deliberately does not check out the repo — it proves the
+      # published module installs from the proxy. go.mod is therefore not on
+      # disk and go-version-file cannot be used; keep this pin in step with go.mod.
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
@@ -206,6 +220,7 @@ jobs:
   update-packages:
     needs: release
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout cli repo
         uses: actions/checkout@v5

.github/workflows/test.yml

@@ -14,8 +14,51 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: gofmt
+        run: |
+          unformatted=$(gofmt -l ./cmd ./pkg ./internal)
+          if [ -n "$unformatted" ]; then
+            echo "::error::these files are not gofmt'd:"
+            echo "$unformatted"
+            exit 1
+          fi
+        shell: bash
+
+      - name: go vet
+        run: go vet ./...
+        env:
+          # The bundled tree-sitter grammars need cgo; -w suppresses their
+          # vendored parser.c warnings (mirrors the justfile).
+          CGO_ENABLED: "1"
+          CGO_CFLAGS: "-w"
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          # Pinned: a linter upgrade must be a deliberate commit, not a
+          # surprise red pipeline on an unrelated PR.
+          version: v1.64.8
+          args: --timeout=10m
+        env:
+          CGO_ENABLED: "1"
+          CGO_CFLAGS: "-w"
+
   test:
     runs-on: ubuntu-latest
+    needs: [lint]
 
     steps:
       - name: Checkout code
@@ -24,7 +67,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.21'
+          go-version-file: go.mod
 
       - name: Build binaries
         run: |

_system.md

@@ -387,7 +387,7 @@ graph TB
 
     subgraph External["External Services"]
         VDBApi["VDB API<br/>api.vdb.vulnetix.com/v1"]
-        AppApi["Vulnetix SaaS<br/>app.vulnetix.com/api"]
+        Console["Vulnetix Console<br/>www.vulnetix.com (device flow)"]
         GHAPI["GitHub API<br/>api.github.com"]
         Registries["Ecosystem Registries<br/>rubygems.org, hex.pm, hackage,<br/>cran, packagist, pub.dev,<br/>cocoapods, juliahub, deps.dev"]
         GHReleases["GitHub Releases<br/>Vulnetix/cli"]
@@ -407,7 +407,8 @@ graph TB
     Version --> UpdatePkg
 
     VDBPkg --> VDBApi
-    UploadPkg --> AppApi
+    UploadPkg --> VDBApi
+    AuthPkg --> Console
     GHPkg --> GHAPI
     LicensePkg --> GHAPI & Registries
     UpdatePkg --> GHReleases
@@ -584,14 +585,12 @@ Two methods, resolved by `vdb.Client.DoRequest()`:
 | `vdb fix-distributions` | GET | `/fix-distributions` | — | `api.go:327` |
 | `vdb purl` | — | Dispatches to one of the above | varies | `vdb.go:749` |
 
-### Upload API (app.vulnetix.com)
+### Upload API (api.vdb.vulnetix.com/v1)
 
 | Operation | Method | Path |
 |-----------|--------|------|
-| Initiate | POST | `/artifact-upload/initiate` |
-| Chunk | POST | `/artifact-upload/chunk/{sessionId}/{chunkNumber}` |
-| Finalize | POST | `/artifact-upload/finalize/{sessionId}` |
-| Verify auth | GET | `/cli/verify` |
+| Upload artifact | POST | `/v2/cli.upload` |
+| Verify auth | GET | `/uploads/verify` |
 
 ### Rate Limit Headers
 

action.yml

@@ -70,9 +70,8 @@ runs:
       shell: bash
       run: |
         vulnetix auth login \
-          --method apikey \
+          --api-key '${{ inputs.api-key }}' \
           --org-id '${{ inputs.org-id }}' \
-          --secret '${{ inputs.api-key }}' \
           --store project
 
     - name: Verify Vulnetix Authentication

cmd/aibom.go

@@ -151,6 +151,7 @@ func runAIBOM(cmd *cobra.Command, args []string) error {
 
 	// Always persist the CycloneDX AIBOM to a file. Default location is
 	// <path>/.vulnetix/ai-bom.cdx.json; --output-file overrides the path.
+	warnOutputExtension(outputFile, ".cdx.json")
 	outFile := outputFile
 	if outFile == "" {
 		outFile = filepath.Join(rootPath, ".vulnetix", "ai-bom.cdx.json")