[imanimanyara]

Summary

go-release.yml set GOPRIVATE and GONOSUMDB to the caller's own org only (github.com/${{ github.repository_owner }}/*). A release that imports a module from another owned org fetched it through proxy.golang.org: sangehq/authama's release pulls github.com/simtabi/go-notifykit/src that way (finding R-INC-13 from the authama review).

• Both variables now list every Simtabi-owned org at job level: simtabi, laranail, ichava, sangehq, simsange, mukoracms, brandgulp, tayariai, tusente, simbi-prjs-clt, simbi-prjs-int. Re-derived 2026-11-14 with gh api user/orgs --jq '.[].login' (12 orgs, less the client-owned adelsaiq).
• No new secret and no git auth change: the modules involved are public, and the job's github.token reaches only the caller's own repository.
• Guard: test_every_owned_org_is_fetched_from_git asserts both variables equal that list (count and set) and that client and deleted orgs (adelsaiq, dannielagumo, joemanch, tayaricms, the-omaris) are absent. Proven red on the old workflow and with adelsaiq swapped in for tusente; green on this change.
• Docs: go-release/README.md gains "Our own modules come from git". Adds the repository's CHANGELOG.md ([Unreleased] plus [1.0.0]).

After merge

Callers pin go-release.yml@<commit> # vX.Y.Z, so they see this only once a new tag (v1.0.1) is cut and their pin moves.

Tests

python3 -m unittest discover in go-release/tests (15), dependabot/tests (32), bot/tests (24): all OK locally.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.