Add static analysis to CI and harden build #58

	name: CI
	permissions:
	contents: read
	pull-requests: write

	on:
	pull_request:
	push:
	branches:
	- main

	jobs:
	lint:
	runs-on: ubuntu-latest
	steps:
	- name: Check out code into the Go module directory
	uses: actions/checkout@v4

	- name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version-file: go.mod

	- name: Check gofmt
	run: \|
	unformatted=$(gofmt -l .)
	if [ -n "$unformatted" ]; then
	echo "The following files are not gofmt-formatted:"
	echo "$unformatted"
	exit 1
	fi

	- name: Go vet
	run: go vet ./...

	- name: golangci-lint
	uses: golangci/golangci-lint-action@v8
	with:
	version: v2.12

	- name: gosec
	uses: securego/gosec@master
	with:
	args: ./...

	build:
	strategy:
	matrix:
	go:
	- '1.26'

	runs-on: ubuntu-latest
	steps:
	- name: Check out code into the Go module directory
	uses: actions/checkout@v4

	- name: Set up Go ${{ matrix.go }}
	uses: actions/setup-go@v5
	with:
	go-version: ${{ matrix.go }}

	- name: Go test
	run: make test

	- name: Go build
	run: make build

Provide feedback