[imanimanyara]

Summary

Moves probaci's release onto simtabi/.github's shared Go release workflow, per the 2026-11-13 standard: binaries ship on the GitHub release only, and a release builds on a pushed version tag or on request.

git push origin vX.Y.Z                                              # builds and publishes vX.Y.Z
gh workflow run release.yml --repo simtabi/probaci -f tag=v0.1.0    # the same, for a tag already pushed (v0.1.0 has no release yet)

• release.yml is now a thin caller of simtabi/.github/.github/workflows/go-release.yml@745880bdb9b35a21eb16824cfc995f16e1e82fd5 (Add the shared Go release workflow .github#27). Its triggers are push: tags (v[0-9]+.[0-9]+.[0-9]+, v[0-9]+.[0-9]+.[0-9]+-*) and workflow_dispatch with a required tag. Concurrency is per tag and never cancelled.
• Each old step maps to the shared workflow: the tag check, checkout, cosign and syft installs, GOPRIVATE/GONOSUMDB, the src/vX.Y.Z alias, CHANGELOG notes, GoReleaser on src/.goreleaser.yaml (cosign-signed checksums kept), and attestation over .cache/goreleaser/checksums.txt. There are no extra assets, so there is no post-release step.
• Go version, kept by an input. The old workflow installed go-version: "1.26" (the newest 1.26 patch, like ci.yml). The shared default, src/go.mod, says go 1.26.0 and would pin the build to 1.26.0. So the caller passes go-version-file: .go-version, a new one-line file containing 1.26, and a test fails if it drifts from ci.yml. This adds a root dotfile, flagged here for review.
• GoReleaser version: the old workflow pinned ~> v2.4. The shared workflow uses ~> v2, and there is no input for it. goreleaser check with 2.20.1 validates the config.
• The shared notes extraction matches src/scripts/extract-changelog.sh for 0.1.0, apart from a leading blank line and the trailing link reference (GitHub does not render it). The script stays.
• Docs: README and docs/installation.md offer the release download (checked against checksums.txt, with gh attestation verify), then a build from source. docs/release.md gives both release commands. src/embedded/ is re-synced with make sync-docs.

Removed

• src/.goreleaser.yaml: the homebrew_casks, scoops and winget blocks. No probaci release was ever published, and simtabi/homebrew-tap and simtabi/scoop-bucket hold no probaci entry, so nothing there is frozen or affected.
• release.yml: the environment: release, the TAP_GITHUB_TOKEN, HOMEBREW_TAP_DEPLOY_KEY and SCOOP_BUCKET_DEPLOY_KEY env, which only fed those blocks, and the confirm=release-go refusal step, which the shared tag check replaces. The repository secrets themselves are untouched.
• Tests: TestReleaseRunsOnlyOnAConfirmedDispatch (and its automaticTrigger regexp) became TestReleaseRunsOnAVersionTagOrOnRequest. New: TestReleaseInputsMatchTheRepository (alias on, this repo's config and changelog, .go-version equal to CI's Go) and TestGoReleaserPublishesNowhereElse, which asserts the three removed blocks, and every other banned block, are absent.

Verification

• go -C src test -count=1 ./... passes; go -C src vet ./... and gofmt -l src are clean; golangci-lint run ./... reports 0 issues; goreleaser check --config src/.goreleaser.yaml (2.20.1) validates; actionlint 1.7.12 is clean.
• Proved red with go test -count=1, then restored: branches: [main], a schedule trigger, uses: pointed elsewhere, go-version-file dropped, .go-version set to 1.25, module-alias-prefix: '', and a brews: block. Each failed its guard.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[imanimanyara]

govulncheck failed on GO-2026-6859 (net/http, fixed in go1.26.11). The job installs go-version: "1.26" with check-latest: false, so it got the runner's cached 1.26.10.

What I chose: .go-version is now the exact 1.26.11, and every setup-go step reads it: the 7 in ci.yml and the one in codeql.yml. The release already reads it through the shared workflow's go-version-file: .go-version.

Why not check-latest: true: that would fix only the CI jobs. The shared release workflow has no such input, so the release would still build on whatever 1.26 patch the runner had cached. With one exact file, CI, CodeQL and the release all build on the same toolchain.

The trade-off: the next Go patch is a one-line bump of .go-version. Nothing upgrades it automatically.

TestReleaseInputsMatchTheRepository now requires an exact 1.y.z in .go-version, every setup-go in ci.yml and codeql.yml reading it, no literal go-version:, and at least 8 setup-go steps inspected. Each assertion was proved red with a literal go-version: "1.26" and with .go-version set to 1.26.