From dfd185c51c83cfe24d7efb19ac33d09e5c168340 Mon Sep 17 00:00:00 2001
From: Nathan Gillett <nathan@intentproof.io>
Date: Sat, 30 May 2026 18:36:36 -0500
Subject: [PATCH] Add Go module release workflow for v0.1 tags

Run CI-parity tests on tag push and create a GitHub Release for
the module tag (Go proxy picks up the tag).
---
 .github/workflows/release-go.yml | 82 ++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)
 create mode 100644 .github/workflows/release-go.yml

diff --git a/.github/workflows/release-go.yml b/.github/workflows/release-go.yml
new file mode 100644
index 0000000..16de813
--- /dev/null
+++ b/.github/workflows/release-go.yml
@@ -0,0 +1,82 @@
+name: release go
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      release_ref:
+        description: Git ref to validate before tagging.
+        required: true
+        default: refs/heads/main
+        type: string
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  test:
+    name: "IntentProof Release: Test Go Module"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref }}
+
+      - name: Checkout intentproof-tools (SPEC_REF source)
+        uses: actions/checkout@v6
+        with:
+          repository: IntentProof/intentproof-tools
+          ref: main
+          path: intentproof-tools
+
+      - name: Read pinned spec ref
+        id: spec_ref
+        run: |
+          ref="$(tr -d '[:space:]' < intentproof-tools/SPEC_REF)"
+          if ! echo "$ref" | grep -qE '^[0-9a-f]{40}$'; then
+            echo "Invalid SPEC_REF in intentproof-tools: '$ref'" >&2
+            exit 1
+          fi
+          echo "ref=$ref" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout intentproof-spec at pinned ref
+        uses: actions/checkout@v6
+        with:
+          repository: IntentProof/intentproof-spec
+          ref: ${{ steps.spec_ref.outputs.ref }}
+          path: intentproof-spec
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Verify sdk-signing fixtures match pinned spec
+        env:
+          INTENTPROOF_SPEC_DIR: intentproof-spec
+        run: bash scripts/check-sdk-signing-fixtures-sync.sh
+
+      - name: Run tests
+        env:
+          GOWORK: off
+        run: go test ./...
+
+  publish:
+    name: "IntentProof Release: Publish Go Module Tag"
+    needs: test
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Create GitHub Release for module tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME}"
+          if ! gh release view "$tag" >/dev/null 2>&1; then
+            gh release create "$tag" --generate-notes --title "$tag"
+          fi