From 20550097139ac217a3eec9c0dd4c02eeb625804a Mon Sep 17 00:00:00 2001
From: Shreyansh Sancheti <43677304+shreyanshjain7174@users.noreply.github.com>
Date: Wed, 19 Aug 2026 14:03:41 +0530
Subject: [PATCH 1/5] ci: add pull_request/push:main workflow with build, vet,
 test -race, gofmt, mod-tidy drift check

Adds .github/workflows/ci.yml. PR #19's release.yml only triggers on
tag push, so pull requests currently get zero validation - six good
first issue tickets invite outside contributors and their PRs would
run nothing.

Installs gcc + libsqlite3-dev since main still uses the CGO
mattn/go-sqlite3 driver as of this commit; comments in the file note
to drop that step and set CGO_ENABLED=0 once PR #20 (pure-Go sqlite
driver swap) merges.

Adds the CI status badge to README.md.

Every step verified locally against current main before opening this
PR: go build, go vet, go test -race, gofmt -l (clean), and go mod
tidy produces no diff. The actual acceptance criterion is that this
fires green on the PR itself, not on local runs - see the PR
description for the live check run link.

Signed-off-by: Shreyansh Sancheti <43677304+shreyanshjain7174@users.noreply.github.com>
---
 .github/workflows/ci.yml | 52 ++++++++++++++++++++++++++++++++++++++++
 README.md                |  2 ++
 2 files changed, 54 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..7fbd3d4
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,52 @@
+name: CI
+
+# NOTE: as of this file's creation, main still uses github.com/mattn/go-sqlite3
+# (CGO), which is why this installs gcc + libsqlite3-dev and does not set
+# CGO_ENABLED=0. PR #20 (github.com/Clawdlinux/agentgate/pull/20) replaces that
+# driver with the pure-Go modernc.org/sqlite. Once #20 merges, delete the
+# "Install sqlite build dependencies" step below and set CGO_ENABLED=0 in the
+# env for every step in this file.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install sqlite build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc libsqlite3-dev
+
+      - name: go build
+        run: go build ./...
+
+      - name: go vet
+        run: go vet ./...
+
+      - name: go test -race
+        run: go test ./... -race
+
+      - name: gofmt
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "${unformatted}" ]; then
+            echo "The following files are not gofmt-formatted:"
+            echo "${unformatted}"
+            exit 1
+          fi
+
+      - name: go mod tidy drift check
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum
diff --git a/README.md b/README.md
index a4b936c..94ee2c7 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # AgentGate
 
+[![CI](https://github.com/Clawdlinux/agentgate/actions/workflows/ci.yml/badge.svg)](https://github.com/Clawdlinux/agentgate/actions/workflows/ci.yml)
+
 A thin API gateway that lets AI agents call SaaS APIs (GitHub, Slack, Google Workspace) on behalf of users. Agents never see tokens — the gateway handles OAuth, encrypted token storage, and request proxying. Every action gets a signed, gap-free receipt that anyone can verify offline, without AgentGate's secret key.
 
 ## Quickstart

From a9803c55b474d15751ea17b400303161188ba964 Mon Sep 17 00:00:00 2001
From: Shreyansh Sancheti <43677304+shreyanshjain7174@users.noreply.github.com>
Date: Wed, 19 Aug 2026 14:15:22 +0530
Subject: [PATCH 2/5] fix(ci): pin DEBIAN_FRONTEND=noninteractive for apt-get
 install

First live run hung 10+ minutes on 'Install sqlite build dependencies'
- almost certainly needrestart/debconf prompting interactively on a
sudo apt-get install with no noninteractive frontend set. Cancelled
that run (32233234510) and fixed rather than reporting the earlier
local-only pass as done.

Signed-off-by: Shreyansh Sancheti <43677304+shreyanshjain7174@users.noreply.github.com>
---
 .github/workflows/ci.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7fbd3d4..c4f56bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,9 +24,11 @@ jobs:
           go-version-file: go.mod
 
       - name: Install sqlite build dependencies
+        env:
+          DEBIAN_FRONTEND: noninteractive
         run: |
           sudo apt-get update
-          sudo apt-get install -y gcc libsqlite3-dev
+          sudo apt-get install -y --no-install-recommends gcc libsqlite3-dev
 
       - name: go build
         run: go build ./...

From ea00336d08b3e4d604bab48eabf2db2aa06aacfd Mon Sep 17 00:00:00 2001
From: Shreyansh Sancheti <43677304+shreyanshjain7174@users.noreply.github.com>
Date: Wed, 19 Aug 2026 14:19:42 +0530
Subject: [PATCH 3/5] fix(ci): wrap apt-get in timeout+retry after a real 10min
 network stall

Run 32233234510's 'Install sqlite build dependencies' step went silent
for over 10 minutes mid apt-get update (checked the actual log
timestamps - real network stall fetching package indices, not a
debconf prompt, not a lock). Wraps both apt-get calls in a 120s
timeout with up to 3 attempts so a future transient mirror stall
fails fast and retries instead of hanging the whole job.

Signed-off-by: Shreyansh Sancheti <43677304+shreyanshjain7174@users.noreply.github.com>
---
 .github/workflows/ci.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c4f56bd..dc7c29a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,8 +27,13 @@ jobs:
         env:
           DEBIAN_FRONTEND: noninteractive
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends gcc libsqlite3-dev
+          for attempt in 1 2 3; do
+            if timeout 120 sudo apt-get update && timeout 120 sudo apt-get install -y --no-install-recommends gcc libsqlite3-dev; then
+              exit 0
+            fi
+            echo "apt-get attempt ${attempt} failed or timed out, retrying..."
+          done
+          exit 1
 
       - name: go build
         run: go build ./...

From 2eb53d93028b1a35a22ede6d153719837884a6d2 Mon Sep 17 00:00:00 2001
From: Shreyansh Sancheti <43677304+shreyanshjain7174@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:33:19 +0530
Subject: [PATCH 4/5] ci: drop CGO build deps now that #20 merged

github.com/Clawdlinux/agentgate/pull/20 replaced mattn/go-sqlite3 with
the pure-Go modernc.org/sqlite. No more gcc/libsqlite3-dev needed, no
more apt-get retry wrapper for the network stall that only existed to
install those. Set CGO_ENABLED=0 globally instead.

Signed-off-by: Shreyansh Sancheti <43677304+shreyanshjain7174@users.noreply.github.com>
---
 .github/workflows/ci.yml | 22 +++-------------------
 1 file changed, 3 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dc7c29a..921a6dc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,18 +1,14 @@
 name: CI
 
-# NOTE: as of this file's creation, main still uses github.com/mattn/go-sqlite3
-# (CGO), which is why this installs gcc + libsqlite3-dev and does not set
-# CGO_ENABLED=0. PR #20 (github.com/Clawdlinux/agentgate/pull/20) replaces that
-# driver with the pure-Go modernc.org/sqlite. Once #20 merges, delete the
-# "Install sqlite build dependencies" step below and set CGO_ENABLED=0 in the
-# env for every step in this file.
-
 on:
   pull_request:
   push:
     branches:
       - main
 
+env:
+  CGO_ENABLED: 0
+
 jobs:
   ci:
     runs-on: ubuntu-latest
@@ -23,18 +19,6 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - name: Install sqlite build dependencies
-        env:
-          DEBIAN_FRONTEND: noninteractive
-        run: |
-          for attempt in 1 2 3; do
-            if timeout 120 sudo apt-get update && timeout 120 sudo apt-get install -y --no-install-recommends gcc libsqlite3-dev; then
-              exit 0
-            fi
-            echo "apt-get attempt ${attempt} failed or timed out, retrying..."
-          done
-          exit 1
-
       - name: go build
         run: go build ./...
 

From 5f4162acd248a4e65e77e738da688a844feebafc Mon Sep 17 00:00:00 2001
From: Shreyansh Sancheti <43677304+shreyanshjain7174@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:35:25 +0530
Subject: [PATCH 5/5] ci: -race needs CGO_ENABLED=1, doesn't need sqlite build
 deps

go test -race genuinely requires cgo on linux (confirmed via a real
failing CI run: 'go: -race requires cgo; enable cgo by setting
CGO_ENABLED=1'), independent of whatever sqlite driver is in use.
ubuntu-latest ships gcc via build-essential, so this needs no apt-get
step -- unlike the old libsqlite3-dev requirement this file used to
work around.

Signed-off-by: Shreyansh Sancheti <43677304+shreyanshjain7174@users.noreply.github.com>
---
 .github/workflows/ci.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 921a6dc..dba1c3d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,6 +26,12 @@ jobs:
         run: go vet ./...
 
       - name: go test -race
+        # -race requires cgo (go: "-race requires cgo; enable cgo by
+        # setting CGO_ENABLED=1"). ubuntu-latest ships gcc via
+        # build-essential by default, so no apt-get install is needed
+        # here, unlike the sqlite3 dev headers this file used to install.
+        env:
+          CGO_ENABLED: 1
         run: go test ./... -race
 
       - name: gofmt