ci: add GitHub Actions workflow for Go tests

Add a CI workflow modeled after tailscale/tailscale that runs on PRs,
pushes to main, and merge groups. The test matrix covers amd64,
amd64 with race detector, and 386. Also runs go vet and checks that
build/test do not modify tracked files or create untracked files.

A check_mergeability job gates on the full matrix for use as a
required status check.

Author: kradalby

.github/workflows/test.yml

@@ -0,0 +1,84 @@
+# Main CI workflow. Runs build, vet, and tests on PRs and merged commits.
+name: CI
+
+on:
+  push:
+    branches:
+      - "main"
+  pull_request:
+    # all PRs on all branches
+  merge_group:
+    branches:
+      - "main"
+
+concurrency:
+  # For PRs, later CI runs preempt previous ones. e.g. a force push on a PR
+  # cancels running CI jobs and starts all new ones.
+  #
+  # For non-PR pushes, concurrency.group needs to be unique for every distinct
+  # CI run we want to have happen. Use run_id, which in practice means all
+  # non-PR CI runs will be allowed to run without preempting each other.
+  group: ${{ github.workflow }}-$${{ github.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false # don't abort the entire matrix if one element fails
+      matrix:
+        include:
+          - goarch: amd64
+          - goarch: amd64
+            buildflags: "-race"
+          - goarch: "386" # thanks yaml
+    runs-on: ubuntu-24.04
+    steps:
+      - name: checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: setup Go
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version-file: go.mod
+
+      - name: build all
+        if: matrix.buildflags == '' # skip on race builder
+        run: go build ./...
+        env:
+          GOARCH: ${{ matrix.goarch }}
+
+      - name: vet
+        if: matrix.buildflags == '' && matrix.goarch == 'amd64'
+        run: go vet ./...
+
+      - name: test all
+        run: go test ${{ matrix.buildflags }} ./...
+        env:
+          GOARCH: ${{ matrix.goarch }}
+
+      - name: check that no tracked files changed
+        run: git diff --no-ext-diff --name-only --exit-code || (echo "Build/test modified the files above."; exit 1)
+
+      - name: check that no new files were added
+        run: |
+          # Note: The "error: pathspec..." you see below is normal!
+          # In the success case in which there are no new untracked files,
+          # git ls-files complains about the pathspec not matching anything.
+          # That's OK. It's not worth the effort to suppress. Please ignore it.
+          if git ls-files --others --exclude-standard --directory --no-empty-directory --error-unmatch -- ':/*'
+          then
+            echo "Build/test created untracked files in the repo (file names above)."
+            exit 1
+          fi
+
+  check_mergeability:
+    if: always()
+    runs-on: ubuntu-24.04
+    needs:
+      - test
+    steps:
+      - name: Decide if change is okay to merge
+        if: github.event_name != 'push'
+        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
+        with:
+          jobs: ${{ toJSON(needs) }}