ci: add GitHub Actions workflow and golangci-lint config

Workflow jobs:
- lint: runs golangci-lint
- test: runs tests with race detection and coverage
- build: builds on Linux, macOS, Windows

Linters enabled:
- errcheck, govet, staticcheck, unused, gosimple
- ineffassign, typecheck, gofmt, goimports
- misspell, gosec

Makefile additions:
- lint: run golangci-lint locally
- ci: run lint + test + build
- tools: install golangci-lint

Author: boneskull

.github/workflows/ci.yml

@@ -0,0 +1,61 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          version: latest
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Run tests
+        run: go test -v -race -coverprofile=coverage.out ./...
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage
+          path: coverage.out
+
+  build:
+    name: Build
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Build
+        run: go build -v ./...

.golangci.yml

@@ -0,0 +1,32 @@
+run:
+  timeout: 5m
+
+linters:
+  enable:
+    - errcheck
+    - govet
+    - staticcheck
+    - unused
+    - gosimple
+    - ineffassign
+    - typecheck
+    - gofmt
+    - goimports
+    - misspell
+    - gosec
+
+linters-settings:
+  errcheck:
+    check-type-assertions: true
+    check-blank: true
+  govet:
+    enable:
+      - shadow
+  gosec:
+    excludes:
+      - G204 # Subprocess launched with variable - we intentionally shell out to git/gh
+
+issues:
+  exclude-use-default: false
+  max-issues-per-linter: 0
+  max-same-issues: 0

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test install clean
+.PHONY: build test lint install clean
 
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
 LDFLAGS := -ldflags "-X github.com/boneskull/gh-stack/cmd.version=$(VERSION)"
@@ -9,6 +9,12 @@ build:
 test:
 	go test ./... -v
 
+lint:
+	golangci-lint run ./...
+
+# Run all checks (what CI does)
+ci: lint test build
+
 install:
 	go install $(LDFLAGS) .
 
@@ -19,3 +25,7 @@ clean:
 gh-install: build
 	mkdir -p ~/.local/share/gh/extensions/gh-stack
 	cp gh-stack ~/.local/share/gh/extensions/gh-stack/
+
+# Install development tools
+tools:
+	go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest