Add comprehensive security regression test suite

.github/workflows/ci.yml

@@ -320,6 +320,39 @@ jobs:
           go test -fuzz=FuzzParseFrontmatter -fuzztime=10s ./pkg/parser/
           go test -fuzz=FuzzExpressionParser -fuzztime=10s ./pkg/workflow/
 
+  security:
+    needs: [test]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    concurrency:
+      group: ci-${{ github.ref }}-security
+      cancel-in-progress: true
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up Go
+        id: setup-go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Report Go cache status
+        run: |
+          if [ "${{ steps.setup-go.outputs.cache-hit }}" == "true" ]; then
+            echo "✅ Go cache hit" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "⚠️ Go cache miss" >> $GITHUB_STEP_SUMMARY
+          fi
+
+      - name: Verify dependencies
+        run: go mod verify
+
+      - name: Run security regression tests
+        run: make test-security
+
   security-scan:
     needs: [test]
     runs-on: ubuntu-latest

Makefile

@@ -99,6 +99,15 @@ fuzz:
 	go test -fuzz=FuzzParseFrontmatter -fuzztime=30s ./pkg/parser/
 	go test -fuzz=FuzzExpressionParser -fuzztime=30s ./pkg/workflow/
 
+# Run security regression tests
+.PHONY: test-security
+test-security:
+	@echo "Running security regression tests..."
+	go test -v -timeout=3m -run '^TestSecurity' ./pkg/workflow/... ./pkg/cli/...
+	@echo "Running security fuzz test seed corpus..."
+	go test -v -timeout=3m -run '^FuzzYAML|^FuzzTemplate|^FuzzInput|^FuzzNetwork|^FuzzSafeJob' ./pkg/workflow/...
+	@echo "✓ Security regression tests passed"
+
 # Test JavaScript files
 .PHONY: test-js
 test-js: build-js
@@ -354,6 +363,7 @@ help:
 	@echo "  build-all        - Build binaries for all platforms"
 	@echo "  test             - Run Go tests (unit + integration)"
 	@echo "  test-unit        - Run Go unit tests only (faster)"
+	@echo "  test-security    - Run security regression tests"
 	@echo "  test-js          - Run JavaScript tests"
 	@echo "  test-all         - Run all tests (Go and JavaScript)"
 	@echo "  test-coverage    - Run tests with coverage report"