The release workflow gates a tag, which is the last possible moment: a
commit that breaks the suite stays green on main until somebody decides
to publish.
Runs go vet and go test on pushes to main and on pull requests. push is
scoped to main so a branch pushed as part of a pull request is not
checked twice, and runs for the same ref cancel each other.
The workflow only built and published, so a tag went straight to
binaries on the releases page with nothing having run against the code
first.
A test job now runs go vet and go test, and build depends on it; release
depends on build, so a tag that fails publishes nothing.
Only runs at release time — a push or pull request is still unchecked.
Niklas Ye