[imanimanyara]

Summary

Brings cloudkit's release workflow onto the org's Go release standard of 2026-11-13: a release runs on a pushed version tag, or on request for a tag already pushed, and on nothing else. This replaces the dispatch gated on -f confirm=release-go, which no release ever used (no version is tagged yet).

git push origin vX.Y.Z                                              # releases vX.Y.Z
gh workflow run release.yml --repo simtabi/cloudkit -f tag=vX.Y.Z    # the same, for a tag already pushed

This is the library exception. Every other Go repository's release.yml calls simtabi/.github's shared go-release.yml, but that workflow runs GoReleaser, and cloudkit has no binaries. So cloudkit keeps its own job and only the triggers change.

• Triggers: push on v[0-9]+.[0-9]+.[0-9]+ and v[0-9]+.[0-9]+.[0-9]+-* tags, plus workflow_dispatch with a required tag input. Concurrency is per tag and never cancelled.
• Tag handling: the tag is inputs.tag || github.ref_name. The first step refuses anything that is not vX.Y.Z[-pre] or not a tag on GitHub, and the checkout is refs/tags/<tag>, so a dispatch can no longer build from a branch.
• Unchanged: the src/vX.Y.Z alias (created if missing, refused if it points elsewhere), the CHANGELOG-section notes (which fail closed), create-or-update of the release, the release environment, and the permissions.
• Guard: TestReleaseRunsOnlyOnAConfirmedDispatch is replaced by TestReleaseRunsOnAVersionTagOrOnRequest. It asserts exactly push + workflow_dispatch, no branch or path filter, version-only tag filters, a required tag input, the tag-check and tag-checkout lines, no release-go, and still nothing that builds or publishes a binary (GoReleaser, the shared go-release.yml, artifacts, Docker, Homebrew, Scoop) outside comments.
• Docs: docs/release.md now describes the two ways and states the library exception. The workflow registration note is gone: it applied only to a dispatch-only workflow, and this one has a push trigger. The CHANGELOG [Unreleased] entry for the release workflow now describes the new triggers.

Verification

• make ci (gofmt check, vet, go test -race -count=1): green. make lint (golangci-lint v2.15.0): 0 issues. actionlint 1.7.12: clean on both workflows.
• The guard was proven red with go test -count=1, one defect at a time, and the file restored (confirmed with cmp). Each of these failed: branches: [main] on the push trigger; a schedule trigger; a '*' tag filter; required: false on the tag input; checkout of main instead of the tag; a goreleaser-action step.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.