Check code with golangci-lint on push

Right now linting failures don't fail the CI job, but they might in the
future.

.github/workflows/go.yml

@@ -14,33 +14,14 @@ jobs:
         with:
           go-version: 1.13
 
-      - name: Check out code into the Go module directory
+      - name: Check out code
         uses: actions/checkout@v2
 
-      - name: Verify dependencies
-        shell: bash
-        run: |
-          go mod verify
-          go mod download
+      - name: Download dependencies
+        run: go mod download
 
       - name: Run tests
-        shell: bash
-        run: |
-          assert-nothing-changed() {
-            local diff
-            git checkout -- .
-            "$@" >/dev/null || true
-            if ! diff="$(git diff -U1 --color --exit-code)"; then
-              printf '\n\e[31mError: running `\e[1m%s\e[22m` results in modifications that you must check into version control:\e[0m\n%s\n' "$*" "$diff" >&2
-              return 1
-            fi
-          }
-
-          STATUS=0
-          go test -race ./... || STATUS=$?
-          assert-nothing-changed go fmt ./... || STATUS=$?
-          assert-nothing-changed go mod tidy || STATUS=$?
-          exit $STATUS
+        run: go test -race ./...
 
       - name: Build
         run: go build -v ./cmd/gh

.github/workflows/lint.yml

@@ -0,0 +1,58 @@
+name: Lint
+on:
+  push:
+    paths:
+    - '**.go'
+    - go.mod
+    - go.sum
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Set up Go 1.13
+        uses: actions/setup-go@v1
+        with:
+          go-version: 1.13
+
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Verify dependencies
+        run: |
+          go mod verify
+          go mod download
+
+          LINT_VERSION=1.24.0
+          curl -fsSL https://github.com/golangci/golangci-lint/releases/download/v${LINT_VERSION}/golangci-lint-${LINT_VERSION}-linux-amd64.tar.gz | \
+            tar xz --strip-components 1 --wildcards \*/golangci-lint
+          mkdir -p bin && mv golangci-lint bin/
+
+      - name: Run checks
+        run: |
+          STATUS=0
+          assert-nothing-changed() {
+            local diff
+            "$@" >/dev/null || return 1
+            if ! diff="$(git diff -U1 --color --exit-code)"; then
+              printf '\e[31mError: running `\e[1m%s\e[22m` results in modifications that you must check into version control:\e[0m\n%s\n\n' "$*" "$diff" >&2
+              git checkout -- .
+              STATUS=1
+            fi
+          }
+
+          assert-nothing-changed go fmt ./...
+          assert-nothing-changed go mod tidy
+
+          bin/golangci-lint run --out-format tab --issues-exit-code 0 | while read -r loc linter msg; do
+            line="${loc#*:}"
+            printf '::warning file=%s,line=%s,col=%s::%s\n' \
+              "${loc%%:*}" "${line%%:*}" "${loc##*:}" \
+              "[$linter] $msg"
+          done
+
+          exit $STATUS
+
+      - name: Build
+        run: go build -v ./cmd/gh