Merge pull request #9 from gosuda/ci/go-verification

ci: run Go regression and security gates on Linux and macOS

Author: lemon-mint

.github/workflows/go-verification.yml

@@ -0,0 +1,73 @@
+name: Go verification
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: go-verification-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  tests:
+    name: Race and integration (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: false # Zero dependencies: no go.sum to key a cache.
+      - name: Unit and race tests
+        run: go test -race -shuffle=on -count=1 ./...
+      - name: Loopback integration and race tests
+        run: go test -race -tags integration -shuffle=on -count=1 ./...
+      - name: NTS-KE parser fuzz smoke
+        run: go test ./nts -run '^$' -fuzz '^FuzzReadServerResponse$' -fuzztime=5s -parallel=2
+
+  quality:
+    name: Static checks and vulnerabilities
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: false
+      - name: Formatting and module hygiene
+        shell: bash
+        run: |
+          files=$(gofmt -l .)
+          if [[ -n "$files" ]]; then
+            printf '%s\n' "$files"
+            exit 1
+          fi
+          go mod tidy
+          git diff --exit-code
+          test -z "$(git status --porcelain)"
+      - name: Vet both build profiles
+        run: |
+          go vet ./...
+          go vet -tags integration ./...
+      - name: Baseline-aware lint
+        # Frozen pre-fix main baseline: three pre-existing ineffectual assignments
+        # in clock/public.go and internal/siv/aes_gcm_siv.go are not introduced here.
+        run: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2 run --no-config --default=none --enable=govet --enable=ineffassign --build-tags=integration --new-from-rev=5b4826e5c712e77f947d73e69f24b940ac3ad4f9 ./...
+      - name: Reachable vulnerability scan
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 -tags integration ./...

docs/verification.md

@@ -0,0 +1,21 @@
+# Verification gates
+
+The Go verification workflow runs on pull requests, pushes to `main`, and manual dispatch. It uses read-only repository permissions, commit-pinned actions, and no persisted checkout credentials.
+
+## Executed checks
+
+- Linux and macOS: regular and `integration` profiles with race detection and shuffled test order.
+- Both platforms: a five-second NTS-KE parser fuzz smoke test. This is bounded smoke coverage, not exhaustive fuzzing.
+- Linux: gofmt, `go mod tidy` with clean-tree verification, vet in both profiles, reachable vulnerability scanning, and baseline-aware govet/ineffassign lint.
+
+Go is read from `go.mod`. Tool versions are pinned in the workflow; update them deliberately. Module caching is disabled because this zero-dependency repository does not contain `go.sum`.
+
+## Lint baseline
+
+Lint reports new findings relative to `5b4826e5c712e77f947d73e69f24b940ac3ad4f9`, the pre-fix `main` revision. Three pre-existing ineffectual assignments (one in `clock/public.go`, two in `internal/siv/aes_gcm_siv.go`) reproduce on that exact revision. The baseline is frozen rather than moved forward on each PR, so subsequently introduced findings remain visible. This gate does not claim those older warnings have been fixed, and is not a full linter suite.
+
+## Limits and merge order
+
+The integration tests use loopback TLS/UDP peers and simulated clocks, not public NTP/NTS servers or actual VM/suspend events. Passing tests do not prove hardware clock guarantees. Vulnerability results depend on the database available when the job runs.
+
+This workflow PR is stacked on the assurance/NTS fixes in PR #7 because it invokes the new `FuzzReadServerResponse` target. Merge #7 first, then retarget this PR to `main`. No branch-protection changes are included; maintainers may require these checks separately.