chore: sync from plugin-template@67f96d0 -- CODE_OF_CONDUCT.md CONTRI… #31

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	ci:
	name: Build, test, lint, and scan
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	go: ["1.25", "1.26"]

	steps:
	- name: Check out repository
	uses: actions/checkout@v6

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: "${{ matrix.go }}.x"
	cache: true

	- name: Download dependencies
	run: go mod download

	- name: Run golangci-lint
	continue-on-error: true
	uses: golangci/golangci-lint-action@v9
	with:
	version: v2.12.2

	- name: Run tests
	run: go test -v -coverprofile=coverage.txt ./...

	- name: Show coverage summary
	run: go tool cover -func=coverage.txt \| tail -1

	- name: Upload coverage report
	if: matrix.go == '1.26'
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
	with:
	name: coverage-report
	path: coverage.txt
	retention-days: 30

	- name: Build plugin binary
	run: go build -v ./cmd/plugin

	- name: Run Trivy filesystem scan
	uses: aquasecurity/trivy-action@v0.36.0
	with:
	scan-type: fs
	scan-ref: .
	format: table
	exit-code: '1'
	ignore-unfixed: true
	severity: CRITICAL,HIGH

Provide feedback