ci: add CI workflows, golangci-lint config, and release pipeline

- Add .golangci.yml (v2 format, standard linters + modernize + gofumpt)
- Add tests.yml: lint/format check and unit tests via Nix on PRs and main
- Add release.yml: build on PRs, push to Docker Hub and Huawei SWR on tag push

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: pan93412

.github/workflows/release.yml

@@ -0,0 +1,63 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Build and push
+    runs-on: blacksmith-2vcpu-ubuntu-2404-arm
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        if: github.event_name != 'pull_request'
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Login to Huawei SWR
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        if: github.event_name != 'pull_request'
+        with:
+          registry: swr.cn-east-3.myhuaweicloud.com
+          username: ${{ secrets.HUAWEI_SWR_USERNAME }}
+          password: ${{ secrets.HUAWEI_SWR_TOKEN }}
+
+      - name: Extract version
+        id: version
+        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Build
+        run: docker buildx bake
+        env:
+          VERSION: ${{ steps.version.outputs.VERSION }}
+
+      - name: Push to Docker Hub
+        if: github.event_name != 'pull_request'
+        run: docker buildx bake --push
+        env:
+          VERSION: ${{ steps.version.outputs.VERSION }}
+
+      - name: Push to Huawei SWR
+        if: github.event_name != 'pull_request'
+        run: docker buildx bake --push
+        env:
+          VERSION: ${{ steps.version.outputs.VERSION }}
+          REGISTRY: swr.cn-east-3.myhuaweicloud.com

.github/workflows/tests.yml

@@ -0,0 +1,54 @@
+name: Tests
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+concurrency:
+  group: tests-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint and format
+    runs-on: blacksmith-2vcpu-ubuntu-2404-arm
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@bafaa638b9d5ec0e7e3ac1a7fc80453ef1fd265f # v3.20.0
+
+      - name: Set up FlakeHub cache
+        uses: DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea # v3.20.0
+
+      - name: Verify formatting
+        run: nix develop --command golangci-lint fmt --diff
+
+      - name: Run golangci-lint
+        run: nix develop --command golangci-lint run ./...
+
+  unit:
+    name: Unit tests
+    runs-on: blacksmith-2vcpu-ubuntu-2404-arm
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@bafaa638b9d5ec0e7e3ac1a7fc80453ef1fd265f # v3.20.0
+
+      - name: Set up FlakeHub cache
+        uses: DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea # v3.20.0
+
+      - name: Run unit tests
+        run: nix develop --command go test ./...

.golangci.yml

@@ -0,0 +1,13 @@
+version: "2"
+
+run:
+  timeout: 5m
+
+linters:
+  default: standard
+  enable:
+    - modernize
+
+formatters:
+  enable:
+    - gofumpt