fix: sandbox permissions #2420

	name: CI

	on:
	pull_request:
	branches: [ main ]
	push:
	branches: [ main ]

	jobs:
	lint:
	runs-on: ubuntu-latest
	strategy:
	matrix:
	goos: [linux, darwin, windows]
	steps:
	- name: Checkout code
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

	- name: Load GO version
	id: versions
	uses: ./.github/actions/load-go-version

	- name: Set up Go
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
	with:
	go-version: ${{ steps.versions.outputs.go-version }}
	cache: true

	- name: Install golangci-lint
	uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20
	with:
	version: v2.10.1
	install-only: true

	- name: Run linting for ${{ matrix.goos }}
	env:
	GOOS: ${{ matrix.goos }}
	run: make lint

	test:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

	- name: Verify vendor/ is not present
	run: stat vendor && exit 1 \|\| exit 0

	- name: Load GO version
	id: versions
	uses: ./.github/actions/load-go-version

	- name: Validate .versions against Dockerfile ARGs
	run: make validate-versions

	- name: Set up Go
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
	with:
	go-version: ${{ steps.versions.outputs.go-version }}
	cache: true

	- name: Check go mod tidy
	run: \|
	go mod tidy
	git diff --exit-code go.mod go.sum

	- name: Run tests with race detection
	run: go test -race ./...

	- name: validate
	run: make validate

Provide feedback