name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

jobs:
  lint-and-test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write # For code scanning
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.25"
          cache: true

      - name: Install dependencies
        run: go mod download

      - name: Lint
        uses: golangci/golangci-lint-action@v6
        with:
          version: latest
          args: --timeout=5m

      - name: Test
        run: go test -v -race -coverprofile=coverage.out ./...

      - name: Upload coverage
        uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: coverage.out