Debounce and caching

.github/workflows/go-ci.yaml

@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+env:
+  GO_VERSION: '1.27.1'
+
+jobs:
+  # Lint job
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+      - uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.13.2
+          args: --timeout 5m
+
+  # Test job
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+      - run: go test ./... -v
+
+  # Security scan job
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+      # gosec is installed rather than run as its container action: the
+      # published image ships its own Go, which lags behind and fails to load
+      # the module ("go.mod requires go >= X"). Installing it here builds gosec
+      # with the toolchain above, so CI's Go version is ours to choose.
+      - run: go install github.com/securego/gosec/v2/cmd/[email protected]
+      - run: gosec ./...