feat(pre-commit-advisory): opt-in private-modules for Go module fetches

.github/workflows/pre-commit-advisory.yml

@@ -48,6 +48,19 @@ on:
         description: "Node version. Ignored when setup-node-pnpm=false."
         type: string
         default: "24"
+      private-modules:
+        description: >-
+          When true, mint a short-lived read-only pinpredict-argocd App token
+          (BOOTSTRAP_APP_ID / BOOTSTRAP_APP_PRIVATE_KEY — callers must pass
+          `secrets: inherit`) and configure a git insteadOf rewrite + GOPRIVATE
+          before running pre-commit, so hooks that resolve Go modules
+          (go-mod-tidy-repo, the golangci-lint typecheck) can fetch private
+          github.com/pinpredict/* modules (e.g. ppkit). Same App and pattern as
+          docker-release.yml's private-modules input. Default false — a no-op
+          for every existing caller.
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -71,6 +84,35 @@ jobs:
         with:
           fetch-depth: 0
 
+      # Opt-in (private-modules: true): mint a short-lived, read-only token for
+      # the org-wide pinpredict-argocd App so module-resolving hooks
+      # (go-mod-tidy-repo, golangci-lint) can fetch private pinpredict Go
+      # modules without vendoring. contents:read across the org (the App is
+      # installed on all repos). Skipped for every caller that leaves
+      # private-modules at its default.
+      - name: Mint private-module read token
+        id: private-module-token
+        if: ${{ inputs.private-modules }}
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.BOOTSTRAP_APP_ID }}
+          private-key: ${{ secrets.BOOTSTRAP_APP_PRIVATE_KEY }}
+          owner: pinpredict
+          permission-contents: read
+
+      # The token never lands in the checkout or the hook-env cache: it lives
+      # in the runner-local global git config, and GOPRIVATE bypasses the
+      # public proxy + checksum DB for org modules.
+      - name: Configure git for private Go modules
+        if: ${{ inputs.private-modules }}
+        env:
+          GH_PRIVATE_TOKEN: ${{ steps.private-module-token.outputs.token }}
+        run: |
+          git config --global \
+            url."https://x-access-token:${GH_PRIVATE_TOKEN}@github.com/pinpredict/".insteadOf \
+            "https://github.com/pinpredict/"
+          echo "GOPRIVATE=github.com/pinpredict/*" >> "$GITHUB_ENV"
+
       # Python is still needed for `language: python` hooks (ruff, …) —
       # go-pre-commit builds their venvs with the interpreter on PATH.
       - uses: actions/setup-python@v6