ci: add reusable Windows and macOS Go CLI matrix

[ORESoftware]

Purpose

Extend the cross-organization CLI portability standard to Go-based command-line repositories without changing the already-certified Rust/Node workflow.

Matrix and validation

Every caller runs independently on Ubuntu 24.04, macOS 15, and Windows 2025. The workflow installs Go from the caller's go.mod, enforces a read-only module graph, verifies formatting of every tracked Go source, runs go vet ./... and go test ./..., proves the selected package is main, builds a trimmed real executable, executes it with --help, and verifies a clean checkout.

Security and reproducibility

• contents: read only;
• checkout and setup-go pinned by full commit SHA;
• no persisted checkout credentials;
• repository-relative working-directory validation;
• GOFLAGS=-mod=readonly and GOTOOLCHAIN=local;
• build output written only under runner temporary storage;
• optional private Git access accepted only as an explicit reusable-workflow secret and removed afterward;
• no package publication, release, API calls, or deployment behavior.

Certification

A companion zed-pkg-test/.github PR will invoke this exact candidate commit with a dependency-free Go CLI fixture on all three operating systems. This PR remains draft until those jobs pass. The test caller will then be repinned to the immutable merge commit and rerun before its own merge.

Refs DEN-3020

[linear-code]

DEN-3020

[ORESoftware]

Public test-organization certification is complete for exact head ac77dc43ccda86797bf7b41901125d799d1dff40.

zed-pkg-test/.github run 31272936571 passed all three independent jobs:

• Ubuntu 24.04
• macOS 15
• Windows 2025

Every job passed exact line-ending normalization, repository-relative input validation, Go installation from go.mod, read-only module download and verification, tracked-source gofmt, go vet ./..., go test ./..., proof that the selected package is main, trimmed real executable build, --help process smoke, and clean-worktree verification.

Central exact-head baseline policy run 31272927974 and public privacy boundary run 31272927964 also passed. The final PR contains only the reusable workflow and its standard; no temporary writer remains.

Refs DEN-3020.