ci: add openssf scorecard analysis #14

	name: CI

	on:
	push:
	branches: [master]
	pull_request:

	permissions:
	contents: read

	jobs:
	test:
	name: Test
	runs-on: ${{ matrix.os }}

	strategy:
	# Fail fast is disabled because there are Go version specific features and tests
	# that should be able to fail independently.
	fail-fast: false
	matrix:
	os: [ubuntu-latest, macos-latest, windows-latest]
	go: ["1.20", "1.21", "1.22", "1.23", "1.24"]

	steps:
	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

	- name: Set up Go
	uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
	with:
	go-version: ${{ matrix.go }}

	- name: Test
	run: go test -race -v ./...

	lint:
	name: Lint
	runs-on: ubuntu-latest

	steps:
	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

	- name: Set up Go
	uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
	with:
	go-version: "1.24"

	- name: Lint
	uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # v7.0.0
	with:
	version: v2.0.2

	dependency-review:
	name: Dependency review
	runs-on: ubuntu-latest
	if: github.event_name == 'pull_request'

	steps:
	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

	- name: Dependency Review
	uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0

Provide feedback