feat: add common github actions

.github/actions/diff-check/action.yml

@@ -0,0 +1,8 @@
+name: Diff Check
+description: Check for uncommitted changes after running a command.
+runs:
+  using: composite
+  steps:
+    - id: check-diff
+      shell: bash
+      run: ${{ github.action_path }}/verify-clean.sh

.github/actions/diff-check/test-verify-clean.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")" && pwd)"
+TESTDIR="$(mktemp -d)"
+trap 'rm -rf "$TESTDIR"' EXIT
+
+cd "$TESTDIR" || exit
+git init
+git config user.email "test@test"
+git config user.name "Test"
+git commit --no-gpg-sign --allow-empty -m "init"
+
+run_test() {
+  local name="$1"
+  local expected_rc="$2"
+  local expected_output="$3"
+
+  echo "=== $name ==="
+  local output
+  set +e
+  output="$("$ROOT/verify-clean.sh" 2>&1)"
+  local rc=$?
+  set -e
+  echo "$output"
+  if [ "$rc" -ne "$expected_rc" ]; then
+    echo "FAIL: expected exit code $expected_rc, got $rc"
+    exit 1
+  fi
+  if echo "$output" | grep -q "$expected_output"; then
+    echo "PASS"
+  else
+    echo "FAIL: expected output to contain '$expected_output'"
+    exit 1
+  fi
+}
+
+run_test "Test 1: clean tree" 0 "clean"
+
+touch new.txt
+run_test "Test 2: untracked file" 1 "dirty"
+
+echo "data" > tracked.txt && git add tracked.txt && git commit --no-gpg-sign -m "add"
+echo "modified" > tracked.txt
+run_test "Test 3: modified tracked file" 1 "dirty"
+
+rm new.txt && git add tracked.txt && git commit --no-gpg-sign -m "fix"
+run_test "Test 4: committed file (should be clean)" 0 "clean"
+
+echo "✅ All tests passed"

.github/actions/diff-check/verify-clean.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ -z "$(git status --porcelain --untracked-files=all)" ]; then
+  echo "::notice::✅ Working tree is clean."
+else
+  echo "::error::❌ Working tree is dirty. Commit or stash the changes below."
+  echo ""
+  echo "Changed files:"
+  git status --short --untracked-files=all
+  exit 1
+fi

.github/actions/get-go-version/action.yml

@@ -0,0 +1,12 @@
+name: Get Go version
+description: Extract Go version from flake.nix
+outputs:
+  version:
+    description: Go version string
+    value: ${{ steps.extract.outputs.version }}
+runs:
+  using: composite
+  steps:
+    - id: extract
+      shell: bash
+      run: ${{ github.action_path }}/extract-go-version.sh

.github/actions/get-go-version/extract-go-version.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+GO_VERSION="$(sed -nE 's/^[[:space:]]*goVersion[[:space:]]*=[[:space:]]*"([0-9]+\.[0-9]+\.[0-9]+)";[[:space:]]*$/\1/p' flake.nix)"
+if [ "$(printf '%s\n' "$GO_VERSION" | sed '/^$/d' | wc -l)" -ne 1 ]; then
+  echo "::error::Expected exactly one goVersion assignment in flake.nix"
+  exit 1
+fi
+echo "version=$GO_VERSION" >> "$GITHUB_OUTPUT"

.github/actions/get-go-version/test-extract-go-version.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")" && pwd)"
+TESTDIR="$(mktemp -d)"
+trap 'rm -rf "$TESTDIR"' EXIT
+
+cd "$TESTDIR"
+
+run_test() {
+  local name="$1"
+  local expected_rc="$2"
+  local expected_output="$3"
+
+  echo "=== $name ==="
+  local output
+  set +e
+  output="$("$ROOT/extract-go-version.sh" 2>&1)"
+  local rc=$?
+  set -e
+  if [ -n "$output" ]; then
+    echo "$output"
+  fi
+  if [ "$rc" -ne "$expected_rc" ]; then
+    echo "FAIL: expected exit code $expected_rc, got $rc"
+    exit 1
+  fi
+  if echo "$output" | grep -q "$expected_output"; then
+    echo "PASS"
+  else
+    echo "FAIL: expected output to contain '$expected_output'"
+    exit 1
+  fi
+}
+
+echo "=== Test 1: extract version ==="
+echo '  goVersion = "1.22.3";' > flake.nix
+GITHUB_OUTPUT="$(mktemp)"
+export GITHUB_OUTPUT
+"$ROOT/extract-go-version.sh"
+version="$(sed 's/^version=//' "$GITHUB_OUTPUT")"
+if [ "$version" != "1.22.3" ]; then
+  echo "FAIL: expected version 1.22.3, got $version"
+  exit 1
+fi
+echo "PASS"
+
+echo '' > flake.nix
+run_test "Test 2: no goVersion (missing)" 1 "Expected exactly one"
+
+printf '  goVersion = "1.22.3";\n  goVersion = "1.23.0";\n' > flake.nix
+run_test "Test 3: multiple matches" 1 "Expected exactly one"
+
+echo "✅ All tests passed"

.github/workflows/test-actions.yml

@@ -0,0 +1,31 @@
+name: Test Actions
+
+on:
+  pull_request:
+    paths:
+      - '.github/actions/**/*.sh'
+  push:
+    branches: [main]
+    paths:
+      - '.github/actions/**/*.sh'
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Run ShellCheck on action scripts
+        run: shellcheck .github/actions/*/*.sh
+
+  test-scripts:
+    needs: shellcheck
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Test verify-clean.sh
+        run: .github/actions/diff-check/test-verify-clean.sh
+      - name: Test extract-go-version.sh
+        run: .github/actions/get-go-version/test-extract-go-version.sh