[auroraxo]

The repo only ships a publish.yml workflow that fires on a v* tag, so nothing compiles or runs cargo test between commits and a release. Adds a minimal CI workflow that runs cargo test -p streamflow-sdk --lib on every push to main and on every pull request, with a cargo cache keyed on Cargo.lock.

This pairs with #6 (which adds the first unit tests for state.rs account-transition helpers). Without this workflow there is no signal that those tests stay green; reviewers have to clone and run cargo test themselves. With it, every future PR gets a one-shot green/red badge.

Scope kept narrow on purpose:

• Only the library crate (--lib) — the #[program] integration path needs the full Anchor toolchain and is out of scope for CI parity with the publish flow.
• No cargo fmt --check, no cargo clippy — the maintainers can add those later if they want; I want this PR to be a 1-commit, 1-file drop-in.

[aikido-pr-checks]

GitHub Action actions/checkout persist Git credentials in workflow - low severity
This actions/checkout step relies on the action's default persist-credentials behavior (true) instead of explicitly configuring it. With that unsafe default, actions/checkout v2 and above persists the GITHUB_TOKEN in the repository's local git config (or, on more recent versions, in a file under $RUNNER_TEMP) for the rest of the workflow run. Subsequent workflow steps or third-party actions can read this token, increasing the risk of credential theft or misuse within the pipeline. This finding is only raised when the step relies on the implicit default; a step that explicitly sets persist-credentials: true because the workflow performs an authenticated git push is not flagged.

Show fix

Remediation: Explicitly set persist-credentials: false on actions/checkout steps that do not need to push commits back to the repository, rather than relying on the unsafe default. If the workflow does perform an authenticated git push, explicitly set persist-credentials: true so the intent is documented and this step won't be re-flagged.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}