From e7bd363519a66cca3c4467a637ff19f6f490d172 Mon Sep 17 00:00:00 2001
From: M <m@t.se>
Date: Fri, 28 Aug 2026 12:10:18 +0200
Subject: [PATCH] Run the tests in CI as a merge gate

---
 .github/workflows/test.yml | 24 ++++++++++++++++++++++++
 README.md                  |  8 +++++---
 2 files changed, 29 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/test.yml

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..d23d851
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,24 @@
+name: Tests
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: vet + fmt + tests
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Latest supported Go
+        run: docker compose run --rm ci
+      - name: Lowest supported Go
+        env:
+          GO_VERSION: 1.22.12
+        run: docker compose run --rm ci
diff --git a/README.md b/README.md
index eeaacdb..e2b75cd 100644
--- a/README.md
+++ b/README.md
@@ -399,14 +399,16 @@ docker compose run --rm --user "$(id -u):$(id -g)" fmt   # gofmt -w .
 docker compose run --rm --user "$(id -u):$(id -g)" tidy  # go mod tidy
 ```
 
-`docker build .` runs `go vet` and the tests, so it works as a CI gate too.
+Every pull request runs `docker compose run --rm ci` against both the latest and
+the lowest supported Go, and must pass before it can be merged. `docker build .`
+runs the same vet and tests locally.
 
 Tests run against the latest Go by default. Set `GO_VERSION` to check the lowest
 supported version too:
 
 ```sh
-GO_VERSION=1.22 docker compose run --rm test   # lowest supported
-docker compose run --rm test                   # latest
+GO_VERSION=1.22.12 docker compose run --rm test   # lowest supported
+docker compose run --rm test                      # latest
 ```
 
 ## Layout