fix(dist): widen replica fan-out on promotion and add forward_promoti… #198

	---
	name: security

	on:
	pull_request:
	push:
	branches: [main]
	schedule:
	- cron: "0 3 * * 1"

	jobs:
	security:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- name: Load project settings
	id: settings
	run: \|
	set -a
	source .project-settings.env
	set +a
	echo "go_version=${GO_VERSION}" >> "$GITHUB_OUTPUT"
	- name: Setup Go
	uses: actions/setup-go@v6
	with:
	go-version: "${{ steps.settings.outputs.go_version }}"
	check-latest: true
	- name: Cache Go modules
	uses: actions/cache@v5
	with:
	path: \|
	~/go/pkg/mod
	~/.cache/go-build
	key: ${{ runner.os }}-go-${{ steps.settings.outputs.go_version }}-${{ hashFiles('**/go.sum') }}
	restore-keys: \|
	${{ runner.os }}-go-${{ steps.settings.outputs.go_version }}-
	- name: Modules
	run: go mod download
	- name: govulncheck
	run: go install golang.org/x/vuln/cmd/govulncheck@latest && govulncheck ./...
	- name: gosec
	run: go install github.com/securego/gosec/v2/cmd/gosec@latest && gosec -exclude-generated -exclude-dir=__examples/size ./...

Provide feedback