fix: restore static linux release builds #220

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	jobs:
	build-and-test:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-go@v5
	with:
	go-version: '1.26'

	- name: Tidy, test, and build
	run: make tidy test build

	- name: Static release build guard
	run: \|
	set -euo pipefail
	for target in linux/amd64 linux/arm64 windows/amd64 windows/arm64; do
	goos="${target%/*}"
	goarch="${target#*/}"
	CGO_ENABLED=0 GOOS="$goos" GOARCH="$goarch" \
	go build -o "$RUNNER_TEMP/gro-$goos-$goarch" ./cmd/gro
	done

	for goarch in amd64 arm64; do
	deps=$(CGO_ENABLED=0 GOOS=linux GOARCH="$goarch" go list -deps ./cmd/gro)
	if printf '%s\n' "$deps" \| grep -E '^(github.com/byteness/keyring\|github.com/1password/onepassword-sdk-go)(/\|$)'; then
	echo "static Linux $goarch build graph must not include byteness/keyring or onepassword-sdk-go"
	exit 1
	fi
	done

	- name: Coverage gate
	run: make test-cover-check

	lint:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-go@v5
	with:
	go-version: '1.26'

	- name: golangci-lint
	uses: golangci/golangci-lint-action@v7
	with:
	version: v2.12.2

Provide feedback