CI: update GitHub Actions and add dependabot

[TopherGopher]

Part of the easymongo refactor (see PLAN.md on the refactor branch).

Working context (read this first)

• Repository github.com/tophergopher/easymongo. Start from branch claude/mongotest-easymongo-refactor-wu2vhm; create a branch issue-<number>-<short-slug> from it and open a pull request back into it. PLAN.md on that branch is the source of truth; read it before writing code.
• Go project, single module, all packages at the repo root except the new easymongotest/ subpackage. The final toolchain target is Go 1.27 (set by Toolchain: go 1.27, latest dependencies, tidy, remove replace directives #10); any Go 1.24 or newer works until then. Before pushing: gofmt -l . prints nothing, go vet ./..., go test -race ./....
• The existing test suite (*_test.go at the root, package easymongo_test, every test function calling setup(t) from common_test.go) is the regression net for this refactor. It must pass after your change. It needs a Docker daemon reachable through the normal Docker environment and the mongo:8 image.
• Order matters. The driver package cannot compile half-migrated (the *mongo.Client type flows from Connection to Database to Collection), so the four driver issues Driver v2: migrate connect.go (mongo.Connect, Disconnect, BSONOptions, write concern) #2, Driver v2: options struct literals become builders; drop MaxTime; ArrayFilters and Delete option changes #3, Driver v2: primitive package merged into bson; replace x/bsonx in index.go #4 and Driver v2: Distinct returns a DistinctResult that must be decoded #5 land together in one pull request, worked in that order. Before them, New easymongotest subpackage wrapping mongotest/v2 #7 and Switch the easymongo test suite to easymongotest #8 must land so the test suite no longer depends on the old github.com/tophergopher/mongotest v0.1.0 module (which itself imports easymongo and breaks the moment easymongo's types change). Until mongotest's v2 module is tagged, use a local replace github.com/tophergopher/mongotest/v2 => ../mongotest/v2 in go.mod and say so in the pull request; Toolchain: go 1.27, latest dependencies, tidy, remove replace directives #10 removes it.
• Method is test-driven: write the tests listed under "Tests first", confirm they fail for the expected reason, then implement. Never delete, skip or weaken an existing test to get green; if a test must change because the public API changed (for example primitive.ObjectID to bson.ObjectID), change only the types.
• Driver v2 reference: https://pkg.go.dev/go.mongodb.org/mongo-driver/v2 and the migration guide https://github.com/mongodb/mongo-go-driver/blob/master/docs/migration-2.0.md. Signatures quoted in these issues were checked against v2.9.0.
• Do not add third-party dependencies unless this issue lists them.
• Tracking issue for the whole refactor: Tracking: easymongo refactor (mongo-driver v2, easymongotest helpers, toolchain) #13. The mongotest side is tracked in Tracking: mongotest refactor (stdlib Docker client, driver v1/v2 modules, lighter dependencies) mongotest#48.
• Commit messages: imperative summary line, blank line, body explaining why. Mention this issue number in the pull request description.

Scope

.github/workflows/go.yml:

• actions/checkout and actions/setup-go at @v7 (both; verified 2026-09-09); setup-go with go-version-file: go.mod and check-latest: true.
• Replace go get -v -t -d ./... (deprecated -d) with go mod download.
• build job: gofmt -l . must print nothing, go vet ./..., go build ./....
• test job: pre-pull mongo:8 for stable timings, then go test -v -race -covermode=atomic -coverpkg=./... -coverprofile=coverage.out ./... (Docker is available on ubuntu-latest; integration tests fail rather than skip when it is not).
• Coverage conversion and upload with jandelgado/gcov2lcov-action@v1 and coverallsapp/github-action@v2.
• Trigger on push to master and on pull requests.

New .github/dependabot.yml with gomod (weekly) and github-actions (weekly) ecosystems; the repo currently has none.

Implementation details

Workflow skeleton to adapt. Action versions verified on 2026-09-09 from each project's releases page: actions/checkout v7.0.1 (pin @v7), actions/setup-go v7.0.0 (pin @v7; supports the go-version-file and check-latest inputs), coverallsapp/github-action v2.3.8 (pin @v2), jandelgado/gcov2lcov-action v1.2.0 (pin @v1). Re-check the releases pages before merging in case a new major has shipped since.

name: Go
on:
  push: { branches: [master] }
  pull_request: { branches: [master] }
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with: { go-version-file: go.mod, check-latest: true }
      - run: go mod download
      - run: test -z "$(gofmt -l .)"
      - run: go vet ./...
      - run: go build ./...
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with: { go-version-file: go.mod, check-latest: true }
      - run: docker pull mongo:8
      - run: go test -v -race -covermode=atomic -coverpkg=./... -coverprofile=coverage.out ./...
      - uses: jandelgado/gcov2lcov-action@v1
        with: { infile: coverage.out, outfile: coverage.lcov }
      - uses: coverallsapp/github-action@v2
        with: { github-token: ${{ secrets.GITHUB_TOKEN }}, path-to-lcov: coverage.lcov }

.github/dependabot.yml:

version: 2
updates:
  - { package-ecosystem: gomod, directory: "/", schedule: { interval: weekly } }
  - { package-ecosystem: github-actions, directory: "/", schedule: { interval: weekly } }

Acceptance

• CI green on the refactor branch; the README build and coverage badges keep working.

Depends on: #10.