option features.field_presence = IMPLICIT only affects presence
tracking for scalar fields (string, int32, bool, and similar): under
IMPLICIT, a scalar's zero value and 'never set' are indistinguishable,
so protovalidate never skips a scalar field's constraints.

A singular message-typed field always tracks explicit presence in
Protobuf Editions, regardless of the file-level IMPLICIT option, and
there is no way to turn this off. protovalidate skips a field's rules
whenever the field has presence and is unset, so an omitted
message-typed field silently passes validation at its zero value
unless it carries an explicit (buf.validate.field).required = true.

Add a 'Gotchas' section documenting this before Best Practices, and a
one-line comment on the Quick Start example's ServerConfig field
pointing to it, since that field already demonstrates the required
rule without explaining why it is there.

Also ignore .worktrees/, used for isolated git worktree workspaces
during development.

docs(v2/config): explain why message-typed fields need explicit required

See merge request !590

Merged-by: Elliot Forbes <eforbes@gitlab.com>
Approved-by: Elliot Forbes <eforbes@gitlab.com>
Co-authored-by: Reuben Pereira <rpereira@gitlab.com>

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v4.37

See merge request !588

Merged-by: Luke Hollinda <lhollinda@gitlab.com>
Approved-by: Luke Hollinda <lhollinda@gitlab.com>
Co-authored-by: GitLab Renovate Bot <ops-contact+gl-common-ci-tasks-self-renovate@gitlab.com>

Rename the existing (v1-focused) README to README-v1.md and add a new
root README as a landing page: summarizes LabKit, explains why there are
two modules, and links to the v1 and v2 module READMEs. v1 is marked as
security-updates-only and being phased out in favour of v2.

Adds some emojis to standardize the look and feel of our three READMEs

Adds user reminder that the v1 module has no future plans for active
development.

Drop the release-process section duplicated in README-v1.md and link
both v1 and v2 READMEs to CONTRIBUTING.md so guidance lives in one
place.

Drop the hard-coded reviewer and maintainer names from README-v1.md,
which have gone stale over time, and instead instruct contributors in
CONTRIBUTING.md to assign a project maintainer as reviewer.

Point users to open an issue or reach out in the #labkit Slack channel

Co-authored-by: GitLab Duo <gitlab-duo@gitlab.com>

docs: split README into landing page and per module README

See merge request !592

Merged-by: Matias Alvarez <malvarez@gitlab.com>
Approved-by: Matias Alvarez <malvarez@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>
Reviewed-by: Matias Alvarez <malvarez@gitlab.com>
Co-authored-by: Luke Hollinda <lhollinda@gitlab.com>

golang.org/x/crypto/ssh leaks a zeroed slice tail into
ssh.SupportedAlgorithms().Ciphers on any GOFIPS140 build, and LabKit's
fips.SupportedAlgorithms() passed it straight through to callers.

Root cause, in x/crypto v0.53.0 (still present in v0.54.0):

  - common.go declares `defaultCiphers = supportedCiphers`, so the two slice
    variables share one backing array.
  - cipher.go's init() runs `defaultCiphers = slices.DeleteFunc(...)` under
    fips140.Enabled() to drop ChaCha20-Poly1305. DeleteFunc shifts elements
    down in place and returns a shorter slice, zeroing the tail of the shared
    backing array.
  - supportedCiphers keeps its original length, so its last element is now "".
  - SupportedAlgorithms() returns slices.Clone(supportedCiphers), trailing ""
    included.

The empty name does not reach the wire: ssh.Config.SetDefaults, which
ssh.NewServerConn and ssh.NewClientConn both call unconditionally, drops it
because cipherModes[""] is nil. It is still a malformed value to hand a caller
that logs, validates or persists the list, and it already breaks this package's
own tests.

Replace filterFIPSCompliant with a shared dropAlgorithms helper in a new
untagged fips/filter.go, so the empty-name guard applies in both build
configurations. The guard is needed in both: the trigger is GOFIPS140, not the
`fips` build tag, and the existing FIPS exclusion lists do not contain "" so the
empty entry survives the filter under `-tags fips` as well. Every algorithm
field of SupportedAlgorithms and DefaultAlgorithms now routes through
dropAlgorithms, keeping the nonFIPS* exclusions where they already applied.

dropAlgorithms filters in place, which is safe for every caller here:
ssh.SupportedAlgorithms() returns slices.Clone'd slices, and
ssh.Config.SetDefaults() rebuilds Ciphers, KeyExchanges and MACs into freshly
appended slices rather than aliasing its package globals.

CI never caught this because no job runs GOFIPS140 without `-tags fips`: the
test-fips-native job sets both BUILD_TAGS=fips and GOFIPS140, while test-fips
uses GOEXPERIMENT=boringcrypto. The new fips/filter_test.go is untagged so it
runs in both configurations.

Related: #129
Epic: &22761

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The go directive sets the minimum Go version required to build each
module, an accidental bump forces every downstream consumer to upgrade Go.

This commmit adds scripts/check-go-version.sh, which verifies the go directive in
both modules against pinned constants, and a blocking check-go-version CI
job. Deliberate changes must also update the values in
./scripts/check-go-verison.sh

Note: This MR temporarily pins us to non-zero patch version. We need to
downgrade back to 1.25.0; which will land in follow up MRs.

The failure message's backticks are meant to be shown literally

chore(.gitignore): lefthook-local.yml

See merge request !596

Merged-by: Elliot Forbes <eforbes@gitlab.com>
Approved-by: Elliot Forbes <eforbes@gitlab.com>
Co-authored-by: Luke Hollinda <lhollinda@gitlab.com>

feat: update field constants (labkit-spec v1.0)

See merge request !599

Merged-by: Matias Alvarez <malvarez@gitlab.com>
Approved-by: Matias Alvarez <malvarez@gitlab.com>
Co-authored-by: service-platforms-labkit <service-platforms-labkit@gitlab.com>

chore: update CODEOWNERS

See merge request !600

Merged-by: Luke Hollinda <lhollinda@gitlab.com>
Approved-by: Luke Hollinda <lhollinda@gitlab.com>
Co-authored-by: Kev Kloss <kkloss@gitlab.com>

ci: pin go directive to block accidental version bumps

See merge request !593

Merged-by: Luke Hollinda <lhollinda@gitlab.com>
Approved-by: Matias Alvarez <malvarez@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>

fix(fips): drop empty SSH algorithm names leaked by x/crypto on GOFIPS140 builds

See merge request !594

Merged-by: Matias Alvarez <malvarez@gitlab.com>
Approved-by: Matias Alvarez <malvarez@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>
Co-authored-by: Jason Plum <jplum@gitlab.com>