[aperezg]

Summary

Refresh Killgrave’s maintenance baseline with Go 1.27, updated dependencies, pinned CI actions, and broader acceptance coverage before adding new features.

Changes

• Upgrade Go to 1.27 across the module, Docker builder, CI, release workflow, and contributor instructions.
• Update Cobra, Testify, x/tools, pflag, and httpsnoop; refresh module files.
• Update Checkout and Setup Go to their latest verified releases, pinned to full commit SHAs.
• Enable vet checks and add vulnerability scanning for application and acceptance builds.
• Expand acceptance coverage for:
  • Configuration files, relative paths, and flag precedence.
  • Routing, headers, query parameters, schema validation, and fallback behavior.
  • Proxy modes, request forwarding, and unavailable upstreams.
  • Startup errors and diagnostics.
  • YAML imposters, CORS, watcher reloads, and response sequences.
  • HTTPS, response delays, and graceful SIGINT/SIGTERM shutdown.
• Consolidate fixtures into one archive per scenario, keeping setup and named HTTP exchanges together.
• Improve the harness with isolated temporary directories, bounded waits, response cleanup, failure logs, and listening-port release checks.
• Move the available-port helper into the acceptance test package.
• Add maintenance and release-modernization documentation.

Bug fixes

• Decode YAML schemaFile correctly. Previously, this field was ignored and schema validation was bypassed.
• Correct the TLS proxy unit test to send requests through Killgrave instead of directly to the upstream.

Validation

• Unit tests passed with race detection.
• Acceptance tests passed, including repeated runs with race detection.
• Vet passed for both default and acceptance builds.
• Vulnerability scans reported no findings in either build mode.
• Module verification and diff checks passed.

[joanlopez]

Nice to see the actions being pinned to SHAs here. It could be worth pinning the ones this PR does not touch as well, for consistency: goreleaser-action@v4 and the docker/* actions further down (setup-qemu, setup-buildx, login, metadata, build-push). These are the ones that run with the release and Docker Hub secrets, so they benefit the most.

Not a blocker for this PR, it can be a follow-up.

[aperezg]

My idea is improve all related with the release on other PR that will depends from this one, that will be ok for you?