diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 80b7765..6468e8c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,6 +2,7 @@ on:
   push:
     branches:
       - master
+      - ci-test
   pull_request:
     branches:
       - master
@@ -9,6 +10,12 @@ on:
 # Note that a full "go test" is quite heavy,
 # as it runs many builds under the hood.
 # The default -timeout=10m can be hit by the hosted runners.
+#
+# Also note that we don't use actions/cache for Go on purpose.
+# Caching GOMODCACHE wouldn't help much, as we have few deps.
+# Caching GOCACHE would do more harm than good,
+# as the tests redo most of their work if the garble version changes,
+# and the majority of commits or PRs will do so.
 
 name: Test
 jobs:
@@ -19,22 +26,29 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - name: Install Go
-      uses: actions/setup-go@v2
+    - uses: actions/setup-go@v3
       with:
         go-version: ${{ matrix.go-version }}
-    - name: Checkout code
-      uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Test
-      run: |
-        go env
-        go test -timeout=15m ./...
+      run: go test -timeout=15m ./...
     - name: Test with -race
       # macos and windows tend to be a bit slower,
       # and it's rare that a race in garble would be OS-specific.
       if: matrix.os == 'ubuntu-latest'
-      run: |
-        go test -race -timeout=20m ./...
+      run: go test -race -timeout=20m ./...
+
+    # Static checks from this point forward. Only run on one Go version and on
+    # Linux, since it's the fastest platform, and the tools behave the same.
+    - if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.17.x'
+      run: diff <(echo -n) <(gofmt -d .)
+    - if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.17.x'
+      run: go vet ./...
+    - if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.17.x'
+      uses: dominikh/staticcheck-action@v1.1.0
+      with:
+        version: "2021.1.2"
+        install-go: false
 
   # We don't care about GOARCH=386 particularly,
   # but it helps ensure we support 32-bit hosts and targets well.
@@ -45,16 +59,12 @@ jobs:
     env:
       GOARCH: 386
     steps:
-    - name: Install Go
-      uses: actions/setup-go@v2
+    - uses: actions/setup-go@v3
       with:
         go-version: 1.17.x
-    - name: Checkout code
-      uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Test
-      run: |
-        go env
-        go test -timeout=15m ./...
+      run: go test -timeout=15m ./...
 
   test-gotip:
     runs-on: ubuntu-latest
@@ -76,17 +86,12 @@ jobs:
         GOGC=off ./make.bash
         echo "GOROOT=$HOME/gotip" >>$GITHUB_ENV
         echo "$HOME/gotip/bin" >>$GITHUB_PATH
-    - name: Checkout code
-      uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Test
-      run: |
-        go env
-        go test -timeout=15m ./...
+      run: go test -timeout=15m ./...
 
-  code-checks:
+  script-checks:
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v2
-    - name: Test that only LF line endings are used
-      run: ./scripts/crlf-test.sh
+    - uses: actions/checkout@v3
+    - run: ./scripts/crlf-test.sh
diff --git a/hash.go b/hash.go
index 9048118..f7ccc5b 100644
--- a/hash.go
+++ b/hash.go
@@ -7,13 +7,10 @@ import (
 	"bytes"
 	"crypto/sha256"
 	"encoding/base64"
-	"encoding/hex"
 	"fmt"
 	"go/token"
 	"io"
-	"os"
 	"os/exec"
-	"path/filepath"
 	"strings"
 )
 
@@ -264,30 +261,3 @@ func hashWith(salt []byte, name string) string {
 	}
 	return string(b64Name)
 }
-
-// gocachePathForFile works out the path an object file will take in GOCACHE.
-// At the moment, such an entry is based on the hex-encoded sha256 of the file.
-// We need this code because, in the importcfg files given to us during a build,
-// some of the object files are in temporary "[...]/_pkg_.a" files.
-// To be able to use the files again later, we need their final cache location.
-func gocachePathForFile(path string) (string, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return "", err
-	}
-	defer f.Close()
-
-	hasher.Reset()
-	if _, err := io.Copy(hasher, f); err != nil {
-		return "", err
-	}
-	sum := hex.EncodeToString(hasher.Sum(sumBuffer[:0]))
-	entry := filepath.Join(cache.GoEnv.GOCACHE, sum[:2], sum+"-d")
-
-	// Ensure the file actually exists in the build cache.
-	// If it doesn't, fail immediately, as that's likely a bug in our code.
-	if _, err := os.Stat(entry); err != nil {
-		return "", err
-	}
-	return entry, nil
-}
diff --git a/main.go b/main.go
index 8a11317..7a80467 100644
--- a/main.go
+++ b/main.go
@@ -722,7 +722,7 @@ func transformCompile(args []string) ([]string, error) {
 			stripRuntime(filename, file)
 		}
 		tf.handleDirectives(file.Comments)
-		file = tf.transformGo(filename, file)
+		file = tf.transformGo(file)
 		if newPkgPath != "" {
 			file.Name.Name = newPkgPath
 		}
@@ -1435,7 +1435,7 @@ func recordedAsNotObfuscated(obj types.Object) bool {
 }
 
 // transformGo obfuscates the provided Go syntax file.
-func (tf *transformer) transformGo(filename string, file *ast.File) *ast.File {
+func (tf *transformer) transformGo(file *ast.File) *ast.File {
 	// Only obfuscate the literals here if the flag is on
 	// and if the package in question is to be obfuscated.
 	//
diff --git a/shared.go b/shared.go
index e834175..f4fc4e8 100644
--- a/shared.go
+++ b/shared.go
@@ -1,3 +1,6 @@
+// Copyright (c) 2020, The Garble Authors.
+// See LICENSE for licensing information.
+
 package main
 
 import (