separate out the setup code so that it's logically easier to reason about the different adversarial setup modes #149

	name: CI

	on:
	push:
	branches: ["main"]
	pull_request:
	branches: ["main"]
	schedule:
	# 08:00 UTC on Saturday.
	- cron: "0 8 * * 6"

	jobs:
	go:
	strategy:
	matrix:
	go: ["1.23"]
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Setup
	uses: actions/setup-go@v5
	with:
	go-version: ${{ matrix.go }}

	- name: Test
	run: go test -v ./...

	- name: Format
	run: \|
	gofmt -w -s .
	git diff --exit-code

	- name: Vet
	run: go vet ./...

	- name: Lint
	uses: dominikh/staticcheck-action@v1
	with:
	version: "v0.5.1"
	min-go-version: ${{ matrix.go }}
	install-go: false
	cache-key: ${{ matrix.go }}

	python:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Format
	uses: chartboost/ruff-action@v1
	with:
	args: "format --check"

	- name: Lint
	uses: chartboost/ruff-action@v1

	other:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Setup Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.12"

	- name: Setup Go
	uses: actions/setup-go@v5
	with:
	go-version: "1.23"

	- name: Run extra CI checks
	run: python etc/ci-check.py

	# Workaround for defining ruleset across matrix.
	# See https://github.com/orgs/community/discussions/26822.
	go-results:
	needs: [go]
	if: ${{ always() }}
	runs-on: ubuntu-latest
	steps:
	- name: Check all job status
	if: >-
	${{
	contains(needs.*.result, 'failure')
	\|\| contains(needs.*.result, 'cancelled')
	\|\| contains(needs.*.result, 'skipped')
	}}
	run: exit 1

Provide feedback