[maerlyn5]

Adds .github/workflows/ci.yml. It runs on pull_request and pushes to main, with contents: read permissions and actions pinned by SHA.

Job	Check
gofmt	gofmt -l . must print nothing
go vet	go vet ./...
go test -race	go test -race -count=1 ./..., which runs the OIDC allowlist, TLS verification/reload and --server-name regression tests
Linux build	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath .
CI	Aggregate check. It runs with if: always() and fails unless every job above succeeded

Branch protection: CI is the single required status check on main. The fork does not use a merge queue; #4 removed the merge_group trigger this PR originally added. A failed or cancelled job turns CI red, so it never leaves a required check stuck pending.

This PR also gofmts lib/iputils.go. That file had a pre-existing formatting violation inherited from upstream, and fixing it lets the new check start green.

Publishing and deployment are intentionally out of scope. Murmuration #12025 owns the manual publish workflow (immutable GCS binary plus SHA256, with the digest pinned in Terraform). The CLI flag interface (--tls-cert, --tls-key, --server-name) is unchanged.

Verified locally: gofmt clean, go vet ./..., go test -race -count=1 ./... and the linux/amd64 build all pass.

Created via Murmur

🤖 Generated with Claude Code

Note

Add CI workflow: gofmt, vet, race tests, Linux build

Adds a GitHub Actions pipeline in ci.yml for pull requests, merge-queue checks, and pushes to main. Separate jobs run gofmt validation, go vet, race-enabled tests, and a Linux amd64 build. An aggregate CI job fails unless all required jobs succeed.

• Actions are pinned to commit hashes, repository access is read-only, and PR runs use cancellation-aware concurrency.

^{Macroscope summarized 359a998.}

🐞

Summarization
• Workflow

[macroscopeapp-nonprod]

Approvability

Verdict: Approved at 359a998

Macroscope's review found this PR approvable — This PR adds automated Go quality and Linux build checks and makes a formatting-only source change. It does not change production behavior or introduce the kinds of customer, access, data, or external-system risks that require human review.

^{You can add or adjust custom eligibility rules. Learn more.}