[Copilot]

Adds a minimal CI check so pull requests and post-merge main both run the repository test suite. This surfaces breakage before merge and also catches integration issues introduced at merge time.

• Workflow

  • adds .github/workflows/tests.yml
  • triggers on:
    • pull_request
    • push to main

• Execution

  • checks out the repository with actions/checkout@v4
  • sets up Go from go.mod with actions/setup-go@v5
  • runs the full Go test suite from the repo root

• Behavior

  • keeps CI intentionally narrow: one job, one responsibility
  • uses the repository’s existing canonical test command rather than introducing custom scripts

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  test:
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - run: go test ./...

[Southclaws]

Do not use v* use an exact commit hash - SBOM security. @copilot

[Copilot]

Updated in 4877995 to pin both actions to exact commit SHAs instead of floating major tags.