From feffcf6e014f4093c1b34fdeb9f62a84b9af1bbe Mon Sep 17 00:00:00 2001
From: Florian Kinder <florian.kinder@enthus.de>
Date: Thu, 18 Jun 2026 15:09:38 +0200
Subject: [PATCH 1/3] Add GitHub Actions test workflow with coverage badge

Runs `go test -race` on pushes and PRs. On main, publishes a coverage
badge to an orphan `badges` branch via vladopajic/go-test-coverage
(built-in GITHUB_TOKEN, no external service). README links the Test
status and Coverage badges.
---
 .github/workflows/test.yml | 39 ++++++++++++++++++++++++++++++++++++++
 README.md                  |  3 +++
 2 files changed, 42 insertions(+)
 create mode 100644 .github/workflows/test.yml

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..541505b
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,39 @@
+name: Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: write # push the coverage badge to the `badges` branch (main only)
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Run tests
+        run: go test -race -coverprofile=cover.out ./...
+
+      # On main: write the badge to the `badges` orphan branch (created on first run).
+      # Elsewhere: git-token is empty, so this only reports coverage — no push, no gate.
+      - name: Coverage badge
+        uses: vladopajic/go-test-coverage/action/source@v2
+        with:
+          profile: cover.out
+          git-token: ${{ github.ref_name == 'main' && secrets.GITHUB_TOKEN || '' }}
+          git-branch: badges
diff --git a/README.md b/README.md
index 1b196df..7f58974 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,8 @@
 # pdfdisassembler
 
+[![Test](https://github.com/speedata/pdfdisassembler/actions/workflows/test.yml/badge.svg)](https://github.com/speedata/pdfdisassembler/actions/workflows/test.yml)
+[![Coverage](https://github.com/speedata/pdfdisassembler/raw/badges/.badges/main/coverage.svg)](https://github.com/speedata/pdfdisassembler/actions/workflows/test.yml)
+
 A focused, read-only PDF parser for Go. Built for tooling that **inspects**
 PDFs — accessibility checkers, validators, debuggers — without dragging in
 the writing, optimisation, signing and image-rendering machinery that

From 24ade2c5e174210059e3d0df52996a0d8470b3f0 Mon Sep 17 00:00:00 2001
From: Florian Kinder <florian.kinder@enthus.de>
Date: Thu, 18 Jun 2026 15:17:50 +0200
Subject: [PATCH 2/3] Use prebuilt go-test-coverage Docker action
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The source action compiles the tool with go run, and v2.18.8 needs Go
>= 1.26 while this module pins go 1.23 — the action forces
GOTOOLCHAIN=local so it can't upgrade. The root action runs a prebuilt
image instead, independent of the runner Go version.
---
 .github/workflows/test.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 541505b..ce648e6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,10 +29,12 @@ jobs:
       - name: Run tests
         run: go test -race -coverprofile=cover.out ./...
 
-      # On main: write the badge to the `badges` orphan branch (created on first run).
+      # On main: write the badge to the pre-created `badges` orphan branch.
       # Elsewhere: git-token is empty, so this only reports coverage — no push, no gate.
+      # Docker action (prebuilt image) — avoids compiling the tool, which needs a
+      # newer Go than this module's go.mod pins.
       - name: Coverage badge
-        uses: vladopajic/go-test-coverage/action/source@v2
+        uses: vladopajic/go-test-coverage@v2
         with:
           profile: cover.out
           git-token: ${{ github.ref_name == 'main' && secrets.GITHUB_TOKEN || '' }}

From 25213aeac8a22cb474e0518006510070c2ac8aeb Mon Sep 17 00:00:00 2001
From: Florian Kinder <florian.kinder@enthus.de>
Date: Thu, 18 Jun 2026 15:21:03 +0200
Subject: [PATCH 3/3] Trim coverage-step comments to the non-obvious rationale

---
 .github/workflows/test.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ce648e6..b65afa1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,10 +29,8 @@ jobs:
       - name: Run tests
         run: go test -race -coverprofile=cover.out ./...
 
-      # On main: write the badge to the pre-created `badges` orphan branch.
-      # Elsewhere: git-token is empty, so this only reports coverage — no push, no gate.
-      # Docker action (prebuilt image) — avoids compiling the tool, which needs a
-      # newer Go than this module's go.mod pins.
+      # Root (Docker) action, not /action/source: the source variant compiles the
+      # tool, which needs a newer Go than go.mod pins — and fails the build.
       - name: Coverage badge
         uses: vladopajic/go-test-coverage@v2
         with: