Add integ workflow, build on oldstable

Author: simonmarty

.github/workflows/go.yml

@@ -13,22 +13,27 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
+    strategy:
+      fail-fast: false
+      matrix:
+        go-version: ['stable', 'oldstable']
 
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: "1.24"
+    steps:
+    - uses: actions/checkout@v6
 
-      - name: Build
-        run: go build -v ./...
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version: ${{ matrix.go-version }}
 
-      - name: Test
-        run: go test -v ./secretcache -coverprofile=coverage.out -covermode=atomic
+    - name: Build
+      run: go build -v ./...
 
-      - name: Codecov
-        uses: codecov/codecov-action@v5
-        with:
-          fail_ci_if_error: true
-          use_oidc: true
+    - name: Test
+      run: go test -v ./secretcache -coverprofile=coverage.out -covermode=atomic
+    
+    - name: Codecov
+      uses: codecov/codecov-action@v6
+      with:
+        fail_ci_if_error: true
+        use_oidc: true

.github/workflows/integ.yml

@@ -0,0 +1,38 @@
+name: Integration Tests
+
+on:
+  workflow_dispatch:
+  push:
+    branches: ["master"]
+  pull_request_target:
+    types: [labeled]
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  test:
+    if: |
+      github.event_name != 'pull_request_target' ||
+      contains(github.event.pull_request.labels.*.name, 'safe-to-test')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "stable"
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.ROLE_ARN }}
+          role-session-name: go-caching-${{ github.run_id }}
+          aws-region: us-west-2
+      - name: Build
+        run: go build -v ./...
+      - name: Run integ tests
+        run: go test -v ./scintegtests

.github/workflows/pr_sync.yml

@@ -0,0 +1,31 @@
+name: Remove safe-to-test label when new commits are pushed
+
+on:
+  pull_request_target:
+    types: [synchronize]
+
+jobs:
+  remove-label:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+      contents: read
+    if: |
+      contains(github.event.pull_request.labels.*.name, 'safe-to-test')
+
+    steps:
+      - name: Remove label
+        run: |
+          echo "Removing label '$LABEL_NAME' from PR #$PR_NUMBER on repo $REPO" 
+          gh_status=$(gh api "repos/$REPO/issues/$PR_NUMBER/labels/$LABEL_NAME" -X DELETE | jq 'if type == "object" then .status else empty end' --raw-output)
+          case $gh_status in
+            "") echo "Label removed" ;;
+            404) echo "Label not found — ignoring" ;;
+            *) echo "unexpected HTTP $gh_status" && exit 1 ;;
+          esac
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          LABEL_NAME: safe-to-test
+          REPO: ${{ github.event.pull_request.base.repo.full_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}