Update CI to also test "latest" (go and deps)

Author: tianon

.github/workflows/ci.yml

@@ -12,20 +12,64 @@ defaults:
     shell: 'bash -Eeuo pipefail -x {0}'
 
 jobs:
+
   test:
-    name: Test
+
+    strategy:
+      matrix:
+        go:
+          - release # test the version in Dockerfile + go.mod (the versions we release with)
+          - latest  # test latest (of Go, and deps)
+
+    name: Test (${{ matrix.go }} go)
     runs-on: ubuntu-latest
+
     steps:
+
       - uses: actions/checkout@v4
-      - run: sudo apt-get update && sudo apt-get install -y --no-install-recommends binfmt-support qemu-user-static
-      - run: ./build.sh
+
+      # used for both building "latest" and for govulncheck in the final step
+      - run: docker pull golang
+
+      - name: hack in qemu-binfmt
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends binfmt-support qemu-user-static
+        if: matrix.go == 'release'
+
+      - name: "${{ matrix.go == 'latest' && 'update and build' || 'build' }}"
+        env:
+          go: '${{ matrix.go }}'
+        run: |
+          case "$go" in
+            release) ./build.sh ;;
+
+            latest)
+              user="$(id -u):$(id -g)"
+              docker run --rm --mount "type=bind,src=$PWD,dst=/wd" --workdir /wd --user "$user" --env HOME=/tmp golang bash -Eeuo pipefail -xc '
+                go get -u go@latest ./... # update Go and deps
+                git diff
+
+                export CGO_ENABLED=0 GOFLAGS="-v -trimpath"
+                GOARCH=amd64 go build -o gosu-amd64
+                GOARCH=386   go build -o gosu-i386
+              '
+              ;;
+
+            *) echo >&2 "error: unknown 'go' value: '$go'"; exit 1 ;;
+          esac
+
+      # explicitly test our (native) amd64/i386 binaries
       - run: ./test.sh gosu-amd64
       - run: ./test.sh gosu-i386
       - run: ./test.sh --debian gosu-amd64
       - run: ./test.sh --debian gosu-i386
+
+      # smoke test our Docker image builds
       - run: docker build --pull --file hub/Dockerfile.alpine hub
+        if: matrix.go == 'release'
       - run: docker build --pull --file hub/Dockerfile.debian hub
+        if: matrix.go == 'release'
 
+      # run "govulncheck" automatically to ensure we don't have any new/unknown vulnerabilities
       - name: govulncheck
         run: |
           for gosu in gosu-*; do