Add weekly Dependabot updates for Go modules

.github/dependabot.yml

@@ -0,0 +1,17 @@
+# Dependabot version updates for Go modules.
+# Each run creates dependabot/go_modules/* branches and opens PRs against main.
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    # Group routine bumps into one weekly PR so go.mod / go.sum stay healthy.
+    # Major upgrades still open as individual PRs for review.
+    groups:
+      go:
+        update-types:
+          - minor
+          - patch

.github/workflows/go.yml

@@ -0,0 +1,42 @@
+name: Verify Go build
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: go-verify-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: go-mod-test-build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Verify module checksums
+        run: go mod verify
+
+      - name: Check go.mod and go.sum are tidy
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum
+
+      - name: Test
+        run: go test ./...
+
+      - name: Build release binaries
+        run: make -C build build-all

internal/handlers/azure.go

@@ -82,7 +82,7 @@ func GetAzureClusterIdentity(s *service.Service, ctx context.Context, azureAppAu
 	tokenReq.Header.Add("Metadata", "true")
 	tokenResp, err := s.Client.Do(tokenReq)
 	if err != nil {
-		return "", fmt.Errorf("Calling azure identity token failed: %v" + err.Error())
+		return "", fmt.Errorf("calling azure identity token failed: %w", err)
 	}
 	defer tokenResp.Body.Close()
 
@@ -135,15 +135,15 @@ func GetAzureOIDCToken(s *service.Service, ctx context.Context,
 	// Get oidc token
 	req, err := http.NewRequestWithContext(ctx, "POST", oidcURL, strings.NewReader(data.Encode()))
 	if err != nil {
-		return "", fmt.Errorf("NewRequestWithContext from azure oidc token failed: %v" + err.Error())
+		return "", fmt.Errorf("NewRequestWithContext from azure oidc token failed: %w", err)
 	}
 	// Add headers if needed
 	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
 
 	// Make the request
 	resp, err := s.Client.Do(req)
 	if err != nil {
-		return "", fmt.Errorf("Calling azure oidc token failed: %v" + err.Error())
+		return "", fmt.Errorf("calling azure oidc token failed: %w", err)
 	}
 	defer resp.Body.Close()