ci: add GitHub Actions Go test workflow

[cpunion]

No description provided.

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[fennoai]

Missing race detector and verbose output

Consider adding -race flag to detect race conditions and -v for better test output:

run: go test -v -race ./...

[fennoai]

Add comment for fail-fast configuration

The fail-fast: false deviates from the default behavior. Consider adding a comment explaining the rationale:

strategy:
  fail-fast: false  # Allow all Go versions to complete testing even if one fails
  matrix:

[fennoai]

Security: Add explicit permissions

Following the principle of least privilege, explicitly declare minimal permissions. Add at the top level:

permissions:
  contents: read

This prevents the workflow from having unnecessary write access via GITHUB_TOKEN.

[fennoai]

Security: Pin actions to SHA commits

Consider pinning actions to immutable SHA commits instead of tags for better supply chain security:

- name: Checkout
  uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1

Tags can be moved, but SHA commits cannot be changed.

[fennoai]

Performance: Enable dependency caching

Enable built-in caching to significantly speed up CI runs (30-60% faster):

- name: Setup Go
  uses: actions/setup-go@v5
  with:
    go-version: ${{ matrix.go-version }}
    cache: true

This caches both Go modules and build cache automatically.

[fennoai]

Consider testing newer Go versions

The matrix tests Go 1.21.x and 1.22.x, but newer versions (1.23, 1.24, 1.25) are available. Consider:

• Testing the minimum supported version (1.21.x) and latest stable version
• Adding a comment explaining the version selection strategy

This ensures compatibility with current Go releases.

[fennoai]

Good start on CI! The workflow is functional and tests across multiple Go versions. Key improvements to consider:

Critical: Add explicit permissions and enable caching for security and performance.

Enhancement: Consider adding go mod verify, build verification, and linting for more comprehensive CI coverage.