FIeld-only encryption #95

	name: Go Pipeline

	on:
	push:
	branches: ["main"]
	tags: ["v*"]
	pull_request:
	branches: ["main"]

	jobs:
	tests:
	runs-on: ubuntu-22.04 # has to be older
	steps:
	- name: Checkout Code
	uses: actions/checkout@v4

	- name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version: "1.25.5"
	cache: true

	# standard go tests
	- name: Run Standard Tests
	run: go test -v ./...

	# wasm tests
	# - name: Install wasmbrowsertest
	# run: \|
	# go install github.com/agnivade/wasmbrowsertest@latest
	# mv "$(go env GOPATH)/bin/wasmbrowsertest" "$(go env GOPATH)/bin/go_js_wasm_exec"

	# - name: Install Chrome
	# uses: browser-actions/setup-chrome@latest

	# - name: Run WASM Tests
	# run: GOOS=js GOARCH=wasm go test ./pkg/... ./cmd/wasm # no e2e cuz they wont work (no opfsRootHandle exists etc.)

	build-and-release:
	needs: tests # only release if security AND all tests pass
	if: startsWith(github.ref, 'refs/tags/') # only with tag push (vX.X.X)
	runs-on: ubuntu-latest
	permissions:
	contents: write
	steps:
	- name: Checkout Code
	uses: actions/checkout@v4

	- name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version: "1.25.5"
	cache: true

	- name: Build
	run: make production_build_web # just web for now

	- name: Release
	uses: softprops/action-gh-release@v2
	with:
	files: build/web/core.wasm
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback