ci: add test and release workflows

- ci: on push/PR, run rustfmt + cargo test on Linux and macOS (the
  macOS build exercises the dynamic_lookup module link), and run the Lua
  tests under headless Neovim
- release: on a v* tag, build the native module for linux (x86_64,
  aarch64 via cargo-zigbuild), macOS (x86_64, aarch64, ad-hoc signed),
  and windows (best-effort), then publish the per-target shared
  libraries and SHA256SUMS to the GitHub release

Author: willothy

.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  rust:
+    name: rust (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - uses: Swatinem/rust-cache@v2
+      - name: Check formatting
+        run: cargo fmt --all --check
+      - name: Run Rust tests
+        run: cargo test --all
+      # Building the cdylib validates the module link (dynamic_lookup on macOS).
+      - name: Build native module
+        run: cargo build --release
+
+  lua:
+    name: lua (headless nvim)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Install Neovim (stable)
+        run: |
+          curl -fsSL https://github.com/neovim/neovim/releases/download/stable/nvim-linux-x86_64.tar.gz | tar xz
+          echo "$PWD/nvim-linux-x86_64/bin" >> "$GITHUB_PATH"
+      - name: Build native module and run Lua tests
+        run: make test-lua

.github/workflows/release.yml

@@ -0,0 +1,110 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    # The Windows mlua module link is best-effort; a failure here must not block
+    # publishing the other platforms' binaries (Windows users build from source).
+    continue-on-error: ${{ matrix.experimental || false }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-latest
+            builder: zigbuild
+            ext: so
+            built: liblockfile_native.so
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-latest
+            builder: zigbuild
+            ext: so
+            built: liblockfile_native.so
+          - target: x86_64-apple-darwin
+            os: macos-latest
+            builder: cargo
+            ext: so
+            built: liblockfile_native.dylib
+            codesign: true
+          - target: aarch64-apple-darwin
+            os: macos-latest
+            builder: cargo
+            ext: so
+            built: liblockfile_native.dylib
+            codesign: true
+          - target: x86_64-pc-windows-msvc
+            os: windows-latest
+            builder: cargo
+            ext: dll
+            built: lockfile_native.dll
+            experimental: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.target }}
+
+      - name: Install zig
+        if: matrix.builder == 'zigbuild'
+        uses: mlugg/setup-zig@v1
+      - name: Install cargo-zigbuild
+        if: matrix.builder == 'zigbuild'
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-zigbuild
+
+      - name: Build (zigbuild)
+        if: matrix.builder == 'zigbuild'
+        run: cargo zigbuild --release --target ${{ matrix.target }}
+      - name: Build (cargo)
+        if: matrix.builder == 'cargo'
+        run: cargo build --release --target ${{ matrix.target }}
+
+      # Ad-hoc sign so macOS does not block the downloaded dylib.
+      - name: Codesign (macOS)
+        if: matrix.codesign
+        run: codesign --force --sign - "target/${{ matrix.target }}/release/${{ matrix.built }}"
+
+      - name: Package asset
+        shell: bash
+        run: |
+          mkdir -p dist
+          cp "target/${{ matrix.target }}/release/${{ matrix.built }}" \
+             "dist/lockfile_native-${{ matrix.target }}.${{ matrix.ext }}"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: lockfile_native-${{ matrix.target }}
+          path: dist/*
+
+  release:
+    name: publish
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+      - name: Collect binaries and checksums
+        run: |
+          mkdir -p dist
+          find artifacts -type f -name 'lockfile_native-*' -exec cp {} dist/ \;
+          (cd dist && sha256sum * > SHA256SUMS)
+          ls -la dist
+      - uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*
+          fail_on_unmatched_files: false
+          generate_release_notes: true