ci: add GitHub Actions workflow and OpenAPI spec validation tests

- .github/workflows/ci.yml: vet, test, cgo-free static build, and gofmt check
  on push/PR to main and v2 (matches the plan's CGO_ENABLED=0 CI requirement).
- api/spec_test.go: validate the embedded OpenAPI 3.1 document with the existing
  yaml.v3 dependency (no new deps) — asserts version/info, that every path has an
  operation with responses, and that the documented mirror paths are present so
  the spec cannot silently drift from the handlers.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mevdschee

.github/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: CI
+
+on:
+  push:
+    branches: [main, v2]
+  pull_request:
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          check-latest: true
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...
+
+      - name: Build (cgo-free, static single binary)
+        env:
+          CGO_ENABLED: 0
+        run: go build -o github-export .
+
+      - name: gofmt
+        run: |
+          unformatted=$(gofmt -l .)
+          if [ -n "$unformatted" ]; then
+            echo "These files need gofmt:"; echo "$unformatted"; exit 1
+          fi

api/spec_test.go

@@ -0,0 +1,91 @@
+package api
+
+import (
+	"strings"
+	"testing"
+
+	"gopkg.in/yaml.v3"
+)
+
+// openapiDoc is a minimal view of the structure we assert on. It intentionally
+// avoids a heavyweight OpenAPI library to keep the project's dependency set
+// small; it validates the invariants that matter for our hand-written spec.
+type openapiDoc struct {
+	OpenAPI string `yaml:"openapi"`
+	Info    struct {
+		Title   string `yaml:"title"`
+		Version string `yaml:"version"`
+	} `yaml:"info"`
+	Paths map[string]map[string]struct {
+		Responses map[string]any `yaml:"responses"`
+	} `yaml:"paths"`
+}
+
+func loadSpec(t *testing.T) openapiDoc {
+	t.Helper()
+	var doc openapiDoc
+	if err := yaml.Unmarshal(OpenAPISpec, &doc); err != nil {
+		t.Fatalf("openapi.yaml is not valid YAML: %v", err)
+	}
+	return doc
+}
+
+func TestSpecIsOpenAPI31(t *testing.T) {
+	doc := loadSpec(t)
+	if !strings.HasPrefix(doc.OpenAPI, "3.1") {
+		t.Errorf("openapi version = %q, want 3.1.x", doc.OpenAPI)
+	}
+	if doc.Info.Title == "" || doc.Info.Version == "" {
+		t.Errorf("info.title/version must be set: %+v", doc.Info)
+	}
+	if len(doc.Paths) == 0 {
+		t.Fatal("spec declares no paths")
+	}
+}
+
+func TestEveryPathHasAnOperationWithResponses(t *testing.T) {
+	doc := loadSpec(t)
+	methods := map[string]bool{"get": true, "post": true, "put": true, "patch": true, "delete": true}
+	for path, item := range doc.Paths {
+		ops := 0
+		for method, op := range item {
+			if !methods[method] {
+				continue
+			}
+			ops++
+			if len(op.Responses) == 0 {
+				t.Errorf("%s %s declares no responses", strings.ToUpper(method), path)
+			}
+		}
+		if ops == 0 {
+			t.Errorf("path %s has no HTTP operations", path)
+		}
+	}
+}
+
+// TestDocumentedMirrorPathsPresent guards against the spec drifting away from
+// the endpoints the server actually mirrors. If a handler path is renamed, this
+// list and the spec must be updated together.
+func TestDocumentedMirrorPathsPresent(t *testing.T) {
+	doc := loadSpec(t)
+	want := []string{
+		"/repos/{owner}/{repo}",
+		"/repos/{owner}/{repo}/issues",
+		"/repos/{owner}/{repo}/issues/{number}",
+		"/repos/{owner}/{repo}/issues/{number}/comments",
+		"/repos/{owner}/{repo}/pulls",
+		"/repos/{owner}/{repo}/pulls/{number}",
+		"/repos/{owner}/{repo}/pulls/{number}/reviews",
+		"/repos/{owner}/{repo}/labels",
+		"/repos/{owner}/{repo}/releases",
+		"/repos/{owner}/{repo}/commits",
+		"/repos/{owner}/{repo}/contents/{path}",
+		"/search/issues",
+		"/status",
+	}
+	for _, p := range want {
+		if _, ok := doc.Paths[p]; !ok {
+			t.Errorf("OpenAPI spec is missing documented path %q", p)
+		}
+	}
+}