From eae6b3baf0c1d1c02ae15c200b24f592c08b9733 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Sun, 15 Mar 2026 19:57:02 +0100
Subject: [PATCH 1/5] ci: gha: format ci.yaml

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 .github/workflows/ci.yaml | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 738605e..613f199 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -17,16 +17,16 @@ jobs:
         platform: [ubuntu-latest]
     runs-on: ${{ matrix.platform }}
     steps:
-    - name: Install Go
-      uses: actions/setup-go@v5
-      with:
-        go-version: ${{ matrix.go-version }}
-    - name: Checkout code
-      uses: actions/checkout@v4
-    - name: Validate headers
-      if: startsWith(matrix.go-version, '1.13') == false
-      run: |
-        go install github.com/containerd/ltag@latest \
-        && ./scripts/validate/fileheader
-    - name: Test
-      run: go test -v ./...
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ matrix.go-version }}
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Validate headers
+        if: startsWith(matrix.go-version, '1.13') == false
+        run: |
+          go install github.com/containerd/ltag@latest \
+          && ./scripts/validate/fileheader
+      - name: Test
+        run: go test -v ./...

From e060b910adb26bc660975da3d0233f96c3c40c43 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Sun, 15 Mar 2026 19:49:28 +0100
Subject: [PATCH 2/5] ci: update workflow config

- set default permissions to 'content: read'
- limit concurrency
- set GOTOOLCHAIN: local to make sure the expected version of
  Go is used (prevent implicit upgrading)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 .github/workflows/ci.yaml | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 613f199..744de49 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,11 +1,16 @@
-name: Continuous Integration
+name: CI
 
-on:
-  push:
-    branches:
-      - main
-      - master
-  pull_request:
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on: [push, pull_request]
+
+env:
+  GOTOOLCHAIN: local
 
 jobs:
   test:

From d5a31fab24a670730c7797448114264b2b0d6b92 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Sun, 15 Mar 2026 19:53:22 +0100
Subject: [PATCH 3/5] ci: update to actions/setup-go@v6, actions/checkout@v6

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 .github/workflows/ci.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 744de49..3be772b 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -23,11 +23,11 @@ jobs:
     runs-on: ${{ matrix.platform }}
     steps:
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go-version }}
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Validate headers
         if: startsWith(matrix.go-version, '1.13') == false
         run: |

From c5a3b656ababb767ef1785b8aa875d174974df7c Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Sun, 15 Mar 2026 19:54:04 +0100
Subject: [PATCH 4/5] ci: test on go1.13.x, oldstable, stable

Test the oldest version supported by the module, and currently
supported versions.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 .github/workflows/ci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3be772b..4cb44fc 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 10
     strategy:
       matrix:
-        go-version: [1.13.x, 1.21.x, 1.22.x]
+        go-version: [1.13.x, oldstable, stable]
         platform: [ubuntu-latest]
     runs-on: ${{ matrix.platform }}
     steps:

From 206d7554c2c2b78d152cbd4a681910950e1adfa1 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Sun, 15 Mar 2026 19:58:54 +0100
Subject: [PATCH 5/5] ci: test with -race

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 .github/workflows/ci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 4cb44fc..0b08eed 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -34,4 +34,4 @@ jobs:
           go install github.com/containerd/ltag@latest \
           && ./scripts/validate/fileheader
       - name: Test
-        run: go test -v ./...
+        run: go test -race -v ./...