[imanimanyara]

Summary

Moves osaat's release onto simtabi/.github's shared Go release workflow, per the 2026-11-13 standard: binaries ship on the GitHub release only, and a release builds on a pushed version tag or on request.

git push origin vX.Y.Z                                            # builds and publishes vX.Y.Z
gh workflow run release.yml --repo simtabi/osaat -f tag=vX.Y.Z    # the same, for a tag already pushed

• release.yml is now a thin caller of simtabi/.github/.github/workflows/go-release.yml@745880bdb9b35a21eb16824cfc995f16e1e82fd5 (Add the shared Go release workflow .github#27). Its triggers are push: tags (v[0-9]+.[0-9]+.[0-9]+, v[0-9]+.[0-9]+.[0-9]+-*) and workflow_dispatch with a required tag. Concurrency is per tag and never cancelled.
• Every step the old workflow had is covered by the shared workflow's defaults: src/.goreleaser.yaml, src/go.mod, the src/vX.Y.Z alias tag, notes from CHANGELOG.md, syft for SBOMs, and attestation over checksums.txt (it reads dist: .cache/goreleaser from the config). This repo has no extra assets, so there is no post-release step.
• The shared notes extraction matches src/scripts/extract-changelog.sh for 0.1.1 and 0.1.0, apart from a leading blank line and, for the oldest section only, the trailing link-reference definitions (GitHub does not render those). The script stays for local use.
• Docs: README and docs/installation.md offer the release download (checked against checksums.txt, with gh attestation verify), then a build from source. docs/release.md gives both release commands. The 0.1.1 Homebrew cask is described as frozen.

Removed

• src/.goreleaser.yaml: the homebrew_casks, scoops and winget blocks.
• release.yml: the environment: release, the USE_DEPLOY_KEYS env, the Refresh Bot token step (REFRESH_APP_CLIENT_ID / REFRESH_APP_PRIVATE_KEY), the TAP_GITHUB_TOKEN, HOMEBREW_TAP_DEPLOY_KEY and SCOOP_BUCKET_DEPLOY_KEY env, and the SKIP_WINDOWS_PKGS / SKIP_SCOOP switches. These only fed the three blocks above. The repository secrets and variables themselves are untouched.
• The confirm=release-go refusal step. The shared workflow's tag check replaces it.
• Tests: TestReleaseRunsOnlyOnAConfirmedDispatch became TestReleaseRunsOnAVersionTagOrOnRequest. TestReleaseRefusesFirst (confirm step first, alias script inline) became TestReleaseKeepsTheModuleAliasTag, which fails if the caller switches off module-alias-prefix or overrides the config, go.mod or changelog paths. New: TestGoReleaserPublishesNowhereElse asserts that the three removed blocks, and every other banned block, are absent.

The simtabi/homebrew-tap cask for 0.1.1 is not touched. It is frozen: it stays and keeps working, and no release updates it.

Verification

• go -C src test -count=1 ./... passes; go -C src vet ./... and gofmt -l src are clean; golangci-lint run on the changed packages reports 0 issues. The full suite ran with HOME pointed at a temp dir, because the sandbox refuses writes to ~/.config.
• actionlint 1.7.12 is clean on .github/workflows/*.yml.
• Proved red with go test -count=1, then restored: branches: [main] under push, a schedule trigger, uses: pointed at another repo, a '*' tag filter, module-alias-prefix: '', and a brews: block. Each failed its guard.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.