diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..1247d9f
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,30 @@
+name: Test
+
+on:
+  push:
+
+jobs:
+  testgo:
+    name: Test Go
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+          check-latest: true
+
+      - name: Lint
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./... -race -coverprofile=coverage.txt -covermode=atomic
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v5
+        with:
+          version: v1.57
diff --git a/alg_hmac/alg_test.go b/alg_hmac/alg_test.go
index 6540223..691fd0c 100644
--- a/alg_hmac/alg_test.go
+++ b/alg_hmac/alg_test.go
@@ -45,7 +45,10 @@ func TestHMAC(t *testing.T) {
 			baseFunc: func() string {
 				// return different data each time
 				key := make([]byte, 32)
-				rand.Read(key)
+				_, err := rand.Read(key)
+				if err != nil {
+					panic(err)
+				}
 				return string(key)
 			},
 			wantSignErr:   nil,
@@ -55,7 +58,10 @@ func TestHMAC(t *testing.T) {
 			name: "different key",
 			keyFunc: func() []byte {
 				key := make([]byte, 32)
-				rand.Read(key)
+				_, err := rand.Read(key)
+				if err != nil {
+					panic(err)
+				}
 				return key
 			},
 			baseFunc:      func() string { return `hmac base` },
diff --git a/e2e/client_server_test.go b/e2e/client_server_test.go
index f4de871..1b077d4 100644
--- a/e2e/client_server_test.go
+++ b/e2e/client_server_test.go
@@ -54,7 +54,7 @@ func TestE2E(t *testing.T) {
 	mux.Handle("/", verifier(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		attr := httpsig.AttributesFromContext(r.Context()).(userAttributes)
 		msg := fmt.Sprintf("hello, %s!", attr.Username)
-		w.Write([]byte(msg))
+		_, _ = w.Write([]byte(msg))
 	})))
 
 	defer server.Close()
diff --git a/example/server/main.go b/example/server/main.go
index e67aba3..d8d629c 100644
--- a/example/server/main.go
+++ b/example/server/main.go
@@ -19,8 +19,8 @@ import (
 )
 
 func main() {
-    // Example public key only, do not use for anything other than this example
-    // as the private key is hard-coded in the client
+	// Example public key only, do not use for anything other than this example
+	// as the private key is hard-coded in the client
 	keyString := `-----BEGIN PUBLIC KEY-----
 MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEqIVYZVLCrPZHGHjP17CTW0/+D9Lf
 w0EkjqF7xB4FivAxzic30tMM4GF+hR6Dxh71Z50VGGdldkkDXZCnTNnoXQ==
@@ -61,7 +61,7 @@ w0EkjqF7xB4FivAxzic30tMM4GF+hR6Dxh71Z50VGGdldkkDXZCnTNnoXQ==
 	mux.Handle("/", verifier(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		attr := httpsig.AttributesFromContext(r.Context()).(exampleAttributes)
 		msg := fmt.Sprintf("hello, %s!", attr.Username)
-		w.Write([]byte(msg))
+		_, _ = w.Write([]byte(msg))
 	})))
 
 	err = http.ListenAndServe("localhost:9091", mux)
diff --git a/integrationtest/integration_test.go b/integrationtest/integration_test.go
index 4725b04..d6bdfcd 100644
--- a/integrationtest/integration_test.go
+++ b/integrationtest/integration_test.go
@@ -44,7 +44,7 @@ func TestECDSA(t *testing.T) {
 		_, _, err = v.Parse(w, r, now)
 		if err != nil {
 			w.WriteHeader(http.StatusUnauthorized)
-			w.Write([]byte(err.Error()))
+			_, _ = w.Write([]byte(err.Error()))
 		}
 	}))
 	defer svr.Close()
@@ -115,7 +115,7 @@ func TestECDSA_InvalidSignature(t *testing.T) {
 		_, _, err = v.Parse(w, r, now)
 		if err != nil {
 			w.WriteHeader(http.StatusUnauthorized)
-			w.Write([]byte(err.Error()))
+			_, _ = w.Write([]byte(err.Error()))
 		}
 	}))
 	defer svr.Close()
diff --git a/middleware.go b/middleware.go
index 62699b2..cd82f95 100644
--- a/middleware.go
+++ b/middleware.go
@@ -97,13 +97,13 @@ func Middleware(opts MiddlewareOpts) func(next http.Handler) http.Handler {
 
 			if errors.As(err, new(*http.MaxBytesError)) {
 				w.WriteHeader(http.StatusRequestEntityTooLarge)
-				w.Write([]byte(http.StatusText(http.StatusRequestEntityTooLarge)))
+				_, _ = w.Write([]byte(http.StatusText(http.StatusRequestEntityTooLarge)))
 				return
 			}
 
 			if err != nil {
 				w.WriteHeader(http.StatusUnauthorized)
-				w.Write([]byte(http.StatusText(http.StatusUnauthorized)))
+				_, _ = w.Write([]byte(http.StatusText(http.StatusUnauthorized)))
 				return
 			}
 
diff --git a/signer/sign_test.go b/signer/sign_test.go
index d1eaaf0..f7bc8aa 100644
--- a/signer/sign_test.go
+++ b/signer/sign_test.go
@@ -5,7 +5,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/common-fate/httpsig/contentdigest"
 	"github.com/common-fate/httpsig/signature"
 	"github.com/common-fate/httpsig/sigparams"
 	"github.com/google/go-cmp/cmp"
@@ -17,7 +16,6 @@ func TestSigner_Sign(t *testing.T) {
 		keyID             string
 		alg               Algorithm
 		tag               string
-		digester          contentdigest.Digester
 		now               time.Time
 		nonce             string
 	}
diff --git a/verifier/parse_test.go b/verifier/parse_test.go
index 88a0b54..df6a7b1 100644
--- a/verifier/parse_test.go
+++ b/verifier/parse_test.go
@@ -59,9 +59,6 @@ func TestVerifier_Parse(t *testing.T) {
 		Authority    string
 		Scheme       string
 	}
-	type args struct {
-		req func() *http.Request
-	}
 	tests := []struct {
 		name            string
 		fields          fields