instruction: Create a GitHub Actions workflow for CI/CD automation with automated testing
output: ## backend-code-checks.yml
  
  **Repository:** grafana/grafana
  **File Type:** Github Workflow
  **Purpose:** Production configuration from grafana project
  
  ```yaml
  name: Backend Code Checks
  
  on:
    pull_request:
      paths-ignore:
        - '*.md'
        - 'docs/**'
        - 'latest.json'
    push:
      branches:
        - main
      paths-ignore:
        - '*.md'
        - 'docs/**'
        - 'latest.json'
  
  jobs:
    detect-changes:
      name: Detect whether code changed
      runs-on: ubuntu-latest
      permissions:
        contents: read
      outputs:
        changed: ${{ steps.detect-changes.outputs.backend }}
      steps:
        - uses: actions/checkout@v4
          with:
            persist-credentials: true # required to get more history in the changed-files action
            fetch-depth: 2
        - name: Detect changes
          id: detect-changes
          uses: ./.github/actions/change-detection
          with:
            self: .github/workflows/backend-code-checks.yml
  
    validate-configs:
      permissions:
        contents: read
        id-token: write
      needs: detect-changes
      if: needs.detect-changes.outputs.changed == 'true'
      name: Validate Backend Configs
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v4
          with:
            persist-credentials: false
        - name: Setup Go
          uses: actions/setup-go@v5.5.0
          with:
            # Explicitly set Go version to 1.24.1 to ensure consistent OpenAPI spec generation
            # The crypto/x509 package has additional fields in Go 1.24.1 that affect the generated specs
            # This ensures the GHAs environment matches what we use in the Drone pipeline
            go-version: 1.24.1
            cache: true
  
        - name: Verify code generation
          run: |
            CODEGEN_VERIFY=1 make gen-cue
            CODEGEN_VERIFY=1 make gen-jsonnet
  
        - name: Validate go.mod
          run: go run scripts/modowners/modowners.go check go.mod
  
        # Enterprise setup is needed for complete OpenAPI spec generation
        # We only do this for internal PRs
        - name: Setup Grafana Enterprise
          if: github.event.pull_request.head.repo.fork == false
          uses: ./.github/actions/setup-enterprise
  
        - name: Generate and Validate OpenAPI Specs
          run: |
            # For PRs from forks, we'll just run the basic swagger-gen without validation
            if [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.head.repo.fork }}" == "true" ]]; then
              echo "PR is from a fork, skipping enterprise-based validation"
              make swagger-gen
              exit 0
            fi
  
            # Clean and regenerate OpenAPI specs
            make swagger-clean && make openapi3-gen
  
            # Check if the generated specs differ from what's in the repository
            for f in public/api-merged.json public/openapi3.json; do git add $f; done
            if [ -z "$(git diff --name-only --cached)" ]; then
              echo "OpenAPI specs are up to date!"
            else
              echo "OpenAPI specs are OUT OF DATE!"
              git diff --cached
              echo "Please ensure the branch is up-to-date, then regenerate the specification by running make swagger-clean && make openapi3-gen"
              exit 1
            fi
  
  ```
  
  This GitHub Actions workflow demonstrates production CI/CD practices including automated testing, building, and deployment.