Sync `feature/string-templates` branch with `master` #10360

	name: CI

	on:
	push:
	branches:
	- master
	- 'feature/**'
	- 'v**'
	pull_request:
	branches:
	- master
	- 'feature/**'
	- 'v**'

	env:
	GO_VERSION: '1.22'

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.run_id }}
	cancel-in-progress: true

	jobs:
	test:
	name: Test
	runs-on: ubuntu-latest
	steps:
	- name: Install dependencies
	run: sudo apt-get update && sudo apt-get install wabt

	- name: Clone
	uses: actions/checkout@v3
	with:
	# fetch all tags. required to update the embedded version
	fetch-depth: 0

	- name: Setup Go
	uses: actions/setup-go@v3
	with:
	go-version: ${{ env.GO_VERSION }}
	cache: true

	- name: Build
	run: make -j8 build

	- name: Test
	run: make ci

	- name: Upload coverage report
	uses: codecov/codecov-action@v2
	with:
	file: ./coverage.txt
	flags: unittests

	- name: Check tidy
	run: make check-tidy

	lint:
	name: Lint
	runs-on: ubuntu-latest
	steps:
	- name: Clone
	uses: actions/checkout@v3

	- name: Setup Go
	uses: actions/setup-go@v3
	with:
	go-version: ${{ env.GO_VERSION }}
	cache: true

	- name: Lint
	run: make lint-github-actions

	- name: Check license headers
	run: make check-headers

	lint-json:
	name: Lint JSON
	runs-on: ubuntu-latest
	steps:
	- name: Clone
	uses: actions/checkout@v3

	- name: json-syntax-check
	uses: limitusus/json-syntax-check@v1
	with:
	pattern: "\\.json$"

	semgrep:
	name: Semgrep
	runs-on: ubuntu-latest
	container:
	image: returntocorp/semgrep
	# Skip any PR created by dependabot to avoid permission issues:
	if: (github.actor != 'dependabot[bot]')
	steps:
	- name: Clone
	uses: actions/checkout@v3

	- name: semgrep ci
	run: semgrep ci --config semgrep.yaml

Provide feedback