ci: run the test suite with the shipping build tags

.github/workflows/ci.yml

@@ -0,0 +1,67 @@
+name: CI
+
+# Run the Go test suite with the SHIPPING build tags on every PR and push to
+# main, so what we test is what we ship. The duckdb_arrow tag is mandatory —
+# the DuckDB driver gates its Arrow CGO API behind it (see issue #490), so a
+# bare `go test` does not compile the Arrow path. Both shipped variants are
+# covered: standard (-tags=duckdb_arrow) and FIPS (-tags=duckdb_arrow,fips,
+# GOFIPS140), mirroring the build-binaries matrix in release-build.yml.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Test (${{ matrix.variant }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - variant: standard
+            build_tags: duckdb_arrow
+            gofips: ""
+          - variant: fips
+            build_tags: duckdb_arrow,fips
+            gofips: "v1.0.0"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.26.4'
+          cache: true
+
+      # vet only on the standard variant (vet findings are tag-independent;
+      # running once avoids duplicate annotations). No gofmt gate: Go 1.26's
+      # gofmt rewrites doc-comment content (e.g. mangles the `'it''s'` SQL-escape
+      # example in internal/sql/mask.go), so enforcing it in CI would propagate
+      # comment corruption. Format is left to local tooling / review.
+      - name: go vet
+        if: matrix.variant == 'standard'
+        env:
+          CGO_ENABLED: 1
+        run: go vet -tags=duckdb_arrow ./...
+
+      # No -race: bcrypt-based auth tests hard-code 1000ms request timeouts that
+      # the race detector's CPU overhead blows past (not real races — the suite
+      # is race-clean). The #490 goal is tag-correct coverage (test == ship),
+      # which -race is orthogonal to. Race coverage can be added later behind a
+      # carve-out for the timeout-sensitive auth/api packages.
+      - name: go test
+        env:
+          CGO_ENABLED: 1
+          GOFIPS140: ${{ matrix.gofips }}
+        run: go test -tags=${{ matrix.build_tags }} ./...

RELEASE_NOTES_2026.06.2.md

@@ -57,6 +57,8 @@ Both files are attached to the GitHub release and can be ingested directly by DC
 
 The deliverable is signed scan evidence attached to each release, not "zero findings" — transitive OS CVEs from the Debian base layer outside Arc's control are reported but do not gate the release.
 
+**CI now runs the test suite against the shipped build.** A new `CI` workflow runs `go test` on every pull request and push to `main` with the same build tags the release uses — `duckdb_arrow` (standard) and `duckdb_arrow,fips` with `GOFIPS140=v1.0.0` (FIPS variant) — plus `go vet`. Previously the only workflow built and signed binaries but ran no tests, and a bare `go test` (without `-tags=duckdb_arrow`) does not even compile the Arrow query path, because the DuckDB driver gates its Arrow API behind that tag — so automated testing of the code that actually ships was missing. This closes that gap; what CI tests is now what the release builds. (Issue #490, which proposed dropping the tag, was closed: the tag is required by the driver and cannot be removed without a driver change.)
+
 **Signed releases and SLSA Level 3 provenance.** Every release binary and container image is cryptographically signed using [Sigstore/cosign](https://github.com/sigstore/cosign) with keyless OIDC signing — no key material is stored or managed; the GitHub Actions OIDC token is the identity, anchored in the [Rekor](https://rekor.sigstore.dev) public transparency log. Air-gapped and Zarf-based deployments can verify artifacts offline using the bundled signature files.
 
 - `arc-linux-amd64.bundle`, `arc-linux-arm64.bundle` — cosign signature bundles for each binary (signature + Rekor transparency-log entry). Verify with: `cosign verify-blob arc-linux-amd64 --bundle arc-linux-amd64.bundle --certificate-identity-regexp "^https://github.com/Basekick-Labs/arc/" --certificate-oidc-issuer https://token.actions.githubusercontent.com`