chore: various scaffolding fixes

.github/workflows/ci.yml

@@ -0,0 +1,94 @@
+name: ci
+
+on:
+  pull_request:
+    paths-ignore:
+      - "README.md"
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "README.md"
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      - name: Ensure go modules are tidy
+        run: |
+          go mod tidy
+          if [[ -n $(git status -s) ]] ; then
+            echo
+            echo -e "\e[31mRunning 'go mod tidy' changes the current setting"
+            echo -e "\e[31mEnsure to include updated go.mod and go.sum in this PR."
+            echo -e "\e[31mThis is usually done by running 'go mod tidy'\e[0m"
+            git status -s
+            git diff --color
+            exit 1
+          fi
+
+      - name: Ensure generated files are up to date
+        run: |
+          go generate ./...
+          if [[ -n $(git status -s) ]] ; then
+            echo
+            echo -e "\e[31mRunning 'go generate ./...' changes the current setting"
+            echo -e "\e[31mEnsure to include the regenerated files in this PR."
+            echo -e "\e[31mThis is usually done by running 'go generate ./...'\e[0m"
+            git status -s
+            git diff --color
+            exit 1
+          fi
+
+      - name: Run linters
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        with:
+          version: latest
+
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      - run: go mod download
+
+      - run: make build
+
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      - run: go mod download
+
+      - run: make test

.github/workflows/release.yml

@@ -2,31 +2,32 @@ name: Release
 
 on:
   push:
-    # run only against tags
     tags:
-      - "*"
+      - "v[0-9]+.[0-9]+.[0-9]+"
 
+# Releases need permissions to read and write the repository contents.
+# GitHub considers creating releases and uploading assets as writing contents.
 permissions:
   contents: write
-  # packages: write
-  # issues: write
 
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - run: echo "PWD=`pwd`" >> $GITHUB_ENV
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          # Allow goreleaser to access older tag information.
           fetch-depth: 0
-      - run: git fetch --force --tags
-      - uses: actions/setup-go@v5
+
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
-          go-version: ">=1.19.3"
-      - uses: goreleaser/goreleaser-action@v6
+          go-version-file: 'go.mod'
+          cache: false
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
-          distribution: goreleaser
-          version: latest
-          args: release --rm-dist
+          args: release --clean
         env:
+          # GitHub sets the GITHUB_TOKEN secret automatically.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,9 +1,14 @@
+# If you prefer the allow list template instead of the deny list, see community template:
+# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+#
 # Binaries for programs and plugins
 *.exe
 *.exe~
 *.dll
 *.so
 *.dylib
+*.DS_Store
+*.vscode
 
 # Test binary, built with `go test -c`
 *.test
@@ -13,7 +18,10 @@
 
 # Dependency directories (remove the comment below to include it)
 # vendor/
-build/
-bin/
 
+# Go workspace file
+go.work
+go.work.sum
+
+bin/
 dist/

.golangci.yaml

@@ -0,0 +1,40 @@
+version: "2"
+linters:
+  enable:
+    - copyloopvar
+    - durationcheck
+    - errcheck
+    - forcetypeassert
+    - ineffassign
+    - godot
+    - gosec
+    - govet
+    - makezero
+    - misspell
+    - nilerr
+    - predeclared
+    - sloglint
+    - staticcheck
+    - unconvert
+    - unparam
+    - unused
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$