feat: add CI pipeline, pin golangci-lint, fix tmux session ID race

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  unit:
+    name: Unit tests + coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - run: make coverage
+
+  integration:
+    name: Integration tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Install tmux
+        run: sudo apt-get update && sudo apt-get install -y tmux
+      - run: make test-integration
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - run: make lint

Makefile

@@ -3,7 +3,7 @@ INSTALL   := $(HOME)/.local/bin/$(BIN_NAME)
 LDFLAGS   := -ldflags "-s -w -X main.version=$(shell git describe --tags --always --dirty 2>/dev/null || echo dev)"
 COVERAGE_THRESHOLD := 80
 
-.PHONY: build install test test-integration coverage lint clean deps setup check
+.PHONY: build install test test-integration coverage lint clean deps setup check vendor tools
 
 deps:
 	go mod download
@@ -31,7 +31,13 @@ coverage:
 	           else { print "OK: " cov "% >= " thr "%" } }'
 
 lint:
-	golangci-lint run ./...
+	go tool golangci-lint run ./...
+
+vendor:
+	go mod vendor
+
+tools:
+	go install tool
 
 clean:
 	rm -f $(BIN_NAME) coverage.out
@@ -42,6 +48,6 @@ format:
 check: coverage test-integration lint build
 	@echo "All checks passed"
 
-setup: deps check
+setup: deps vendor tools check
 	@echo "Setup complete"
 

cmd/template_integration_test.go

@@ -0,0 +1,33 @@
+//go:build integration
+
+package cmd_test
+
+import (
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+// TestTemplate_detectBranchFromGit verifies that when --branch is omitted, the
+// branch is auto-detected via git from the target directory. Requires git.
+func TestTemplate_detectBranchFromGit(t *testing.T) {
+	repoDir := t.TempDir()
+	for _, c := range [][]string{
+		{"git", "init", repoDir},
+		{"git", "-C", repoDir, "config", "user.email", "test@test.com"},
+		{"git", "-C", repoDir, "config", "user.name", "Test"},
+		{"git", "-C", repoDir, "checkout", "-b", "my-branch"},
+		{"git", "-C", repoDir, "commit", "--allow-empty", "-m", "init"},
+	} {
+		if out, err := exec.Command(c[0], c[1:]...).CombinedOutput(); err != nil {
+			t.Fatalf("git setup %v: %v\n%s", c, err, out)
+		}
+	}
+
+	projectsDir := t.TempDir()
+	cfgPath := writeConfig(t, projectsDir)
+	err := runCmd(t, "--config", cfgPath, "template", "--project", "myapp", repoDir)
+	if err != nil && strings.Contains(err.Error(), "could not detect branch") {
+		t.Fatalf("detectGitBranch failed to auto-detect branch: %v", err)
+	}
+}

cmd/template_test.go

@@ -132,24 +132,6 @@ func TestTemplate_resolveProjectFromCloneDir(t *testing.T) {
 	}
 }
 
-// TestTemplate_detectBranchFromGit verifies that when --branch is omitted, the
-// branch is auto-detected via git from the target directory.
-func TestTemplate_detectBranchFromGit(t *testing.T) {
-	projectsDir := t.TempDir()
-	// Use a real git directory (the repo itself) so detectGitBranch succeeds.
-	// We pass --project and the repo root dir (which is a real git repo).
-	cfgPath := writeConfig(t, projectsDir)
-	// The current working directory is the repo root — it has a valid git branch.
-	// No .herd files in the repo root, so template processing returns 0 results.
-	// We expect success (no error), not "could not detect branch".
-	err := runCmd(t, "--config", cfgPath, "template", "--project", "myapp", ".")
-	// May fail if "." isn't in a known worktree path for project resolution,
-	// but should NOT fail with "could not detect branch".
-	if err != nil && strings.Contains(err.Error(), "could not detect branch") {
-		t.Fatalf("detectGitBranch failed to auto-detect branch: %v", err)
-	}
-}
-
 // TestTemplate_resolveProjectFromDir verifies auto-detection from directory path.
 func TestTemplate_resolveProjectFromDir(t *testing.T) {
 	projectsDir := t.TempDir()