ci(release): issue Homebrew tap token via Vault instead of a static PAT #41

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	jobs:
	# Doc/flag correctness is enforced as a hard gate by cmd/doccontract_test.go,
	# which runs as part of `go test ./...` below.
	test:
	strategy:
	matrix:
	os: [ubuntu-latest, macos-latest, windows-latest]
	runs-on: ${{ matrix.os }}
	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version-file: go.mod

	- name: Build
	run: go build -o band ./cmd/band

	- name: Test
	run: go test ./... -v

	lint:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version-file: go.mod

	- name: Run golangci-lint
	uses: golangci/golangci-lint-action@v7

	security:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version-file: go.mod

	- name: Install govulncheck
	run: go install golang.org/x/vuln/cmd/govulncheck@latest

	- name: Run govulncheck
	run: govulncheck ./...

Provide feedback