feat: workflows and goreleaser #6

	name: Canary Scanner

	on:
	push:
	branches: [ main ]
	pull_request:
	branches: [ main ]

	permissions:
	contents: read

	jobs:
	scan:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version: '1.23' # Using 1.23 as 1.25 is not yet available

	- name: Build canary scanner (main)
	run: go build -o ./bin/canary ./main.go

	- name: Build canary CLI (cmd)
	run: \|
	if [ -d "./cmd/canary" ]; then
	go build -o ./bin/canary-cli ./cmd/canary
	fi

	- name: Run canary scan
	run: ./bin/canary --root . --out status.json --csv status.csv

	- name: Self-verify canary tokens
	run: ./bin/canary --root . --verify GAP_ANALYSIS.md --strict
	continue-on-error: true

	- name: Upload scan results
	uses: actions/upload-artifact@v4
	with:
	name: canary-status
	path: \|
	status.json
	status.csv

	- name: Display scan summary
	run: \|
	echo "=== CANARY Scan Summary ==="
	if [ -f status.json ]; then
	jq '.summary' status.json
	fi
	echo "==========================="

	test:
	runs-on: ubuntu-latest
	needs: scan
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version: '1.23'

	- name: Run acceptance tests
	run: \|
	go test ./internal/acceptance/... -v
	go test ./internal/core/... -v

	- name: Run canary tool tests
	run: \|
	go test ./... -v -race -cover

Provide feedback