The workflow only built and published, so a tag went straight to
binaries on the releases page with nothing having run against the code
first.
A test job now runs go vet and go test, and build depends on it; release
depends on build, so a tag that fails publishes nothing.
Only runs at release time — a push or pull request is still unchecked.
Niklas Ye