Test the PKCS#11 build against SoftHSM in CI and warn once where the build has no driver

.github/workflows/golang-test-linux.yml

@@ -207,6 +207,42 @@ jobs:
         # regression test, and need no frontend bundle.
         run: CGO_ENABLED=1 go test -timeout 5m ./client/ui/authsession/... ./client/ui/i18n/... ./client/ui/preferences/... ./client/ui/services/...
 
+  test_client_pkcs11:
+    name: "Client PKCS#11 / Unit"
+    # The deb and rpm packages ship the client built with the pkcs11 tag, which loads
+    # PKCS#11 modules through purego. The other jobs build without the tag, so this one
+    # compiles that driver and signs with a real SoftHSM token, the build release ships.
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      - name: Install SoftHSM
+        run: sudo apt update && sudo apt install -y -q softhsm2
+
+      - name: Initialise token
+        run: |
+          mkdir -p "$RUNNER_TEMP/softhsm/tokens"
+          printf 'directories.tokendir = %s\nobjectstore.backend = file\n' "$RUNNER_TEMP/softhsm/tokens" > "$RUNNER_TEMP/softhsm/softhsm2.conf"
+          echo "SOFTHSM2_CONF=$RUNNER_TEMP/softhsm/softhsm2.conf" >> "$GITHUB_ENV"
+          SOFTHSM2_CONF="$RUNNER_TEMP/softhsm/softhsm2.conf" softhsm2-util --init-token --free --label netbird --pin 1234 --so-pin 1234
+
+      - name: Vet
+        run: CGO_ENABLED=0 go vet -tags pkcs11 ./client/internal/pkcs11/... ./client/internal/certproof/...
+
+      - name: Test
+        env:
+          NB_TEST_PKCS11_URI: "pkcs11:token=netbird?module-path=/usr/lib/softhsm/libsofthsm2.so&pin-value=1234"
+        run: CGO_ENABLED=0 go test -tags pkcs11 -timeout 5m ./client/internal/pkcs11/... ./client/internal/certproof/...
+
   test_client_on_docker:
     name: "Client (Docker) / Unit"
     needs: [build-cache]