Validate and release with standard Go and GitHub tooling

.github/workflows/ci.yml

@@ -1,49 +1,37 @@
-name: Public protocol CI
+name: CI
 
 on:
   push:
     branches: [main]
   pull_request:
-  workflow_dispatch:
   workflow_call:
 
 permissions:
   contents: read
 
 concurrency:
-  group: protocol-ci-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   test:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
-    env:
-      GOENV: 'off'
-      GOWORK: 'off'
-      GOTOOLCHAIN: local
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.27.1'
-          cache: true
-      - name: Prepare complete module cache
+          go-version-file: go.mod
+      - name: The protocol depends on neither the server nor the SDK and replaces nothing
         run: |
-          module_dir=$(mktemp -d "$RUNNER_TEMP/weir-protocol-module.XXXXXX")
-          cp go.mod go.sum "$module_dir/"
-          (cd "$module_dir" && go mod download all)
-      - name: Offline validation
-        env:
-          GOPROXY: 'off'
-          GOSUMDB: 'off'
+          forbidden=$(go list -m -f '{{if or .Replace (eq .Path "github.com/batchstream/weir") (eq .Path "github.com/batchstream/weir-go")}}{{.Path}}{{end}}' all)
+          echo "$forbidden"
+          test -z "$forbidden"
+      - name: Tests, vet and formatting
         run: |
-          go mod verify
+          go mod tidy -diff
           go test -race -count=1 -timeout=90s ./...
           go vet ./...
-          python3 scripts/check_dependencies.py
-          python3 -m unittest discover -s scripts -p '*_test.py' -v
           test -z "$(gofmt -l .)"
-          git diff --exit-code

.github/workflows/release.yml

@@ -1,10 +1,10 @@
-name: Publish protocol version
+name: Release
 
 on:
   workflow_dispatch:
     inputs:
       version:
-        description: Stable semantic version
+        description: Stable version (vMAJOR.MINOR.PATCH)
         required: true
         type: string
 
@@ -16,25 +16,24 @@ jobs:
     if: github.ref == 'refs/heads/main'
     uses: ./.github/workflows/ci.yml
 
-  publish:
+  release:
     needs: validate
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     concurrency:
-      group: protocol-release
+      group: release
       cancel-in-progress: false
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
-        with:
-          persist-credentials: false
-      - name: Check version and exact main commit
-        env:
-          VERSION: ${{ inputs.version }}
-        run: python3 scripts/release.py --version "$VERSION" --expected-commit "$GITHUB_SHA"
-      - name: Publish validated commit
+      - name: Tag and release the validated commit
         env:
           GH_TOKEN: ${{ github.token }}
           VERSION: ${{ inputs.version }}
-        run: gh release create "$VERSION" --target "$GITHUB_SHA" --title "$VERSION" --generate-notes
+        run: |
+          [[ $VERSION =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
+          # An existing tag is accepted only at this commit, so a rerun can finish a release.
+          if ! gh api "repos/$GITHUB_REPOSITORY/git/refs" -f ref="refs/tags/$VERSION" -f sha="$GITHUB_SHA" >/dev/null; then
+            test "$(gh api "repos/$GITHUB_REPOSITORY/commits/$VERSION" --jq .sha)" = "$GITHUB_SHA"
+          fi
+          gh release create "$VERSION" --repo "$GITHUB_REPOSITORY" --verify-tag --title "$VERSION" --generate-notes

.gitignore

@@ -1,5 +1,3 @@
-__pycache__/
-*.pyc
 coverage.out
 go.work
 go.work.sum

README.md

@@ -131,28 +131,14 @@ follow the Lua contract above.
 ## Validate
 
 ```sh
-module_dir=$(mktemp -d)
-cp go.mod go.sum "$module_dir/"
-(cd "$module_dir" && GOWORK=off go mod download all)
-GOWORK=off GOPROXY=off GOSUMDB=off go mod verify
-GOWORK=off GOPROXY=off GOSUMDB=off go test -race -count=1 ./...
-GOWORK=off GOPROXY=off GOSUMDB=off go vet ./...
-GOWORK=off GOPROXY=off GOSUMDB=off python3 scripts/check_dependencies.py
-python3 -m unittest discover -s scripts -p '*_test.py'
+go test -race ./...
+go vet ./...
 ```
 
-Prepare the complete module cache in a temporary module copy before disabling
-network access. `download all` includes graph/test metadata that lazy runtime
-downloads omit; its extra ZIP checksums stay outside the committed `go.sum`.
-
 Default tests use in-memory protocol data. They do not contact external
-endpoints or start databases. Descriptor tests
-protect the public RPC and field contract.
-The dependency check examines every selected module, including transitive and
-test requirements, rejects Server/SDK dependencies and replacements, examines
-all raw module-graph edges including versioned protocol return edges, then checks
-the complete production and test package graph. It forces workspace mode off
-for every Go subprocess so unrelated checkouts cannot mask module boundaries.
+endpoints or start databases. Descriptor tests protect the public RPC and field
+contract. CI also checks that the module graph contains neither the server nor
+the SDK and that `go.mod` replaces no module.
 
 ## Generate
 
@@ -184,9 +170,7 @@ After the reviewed change is merged, an authorized maintainer can publish:
 gh workflow run release.yml --ref main -f version=vX.Y.Z
 ```
 
-The workflow accepts only stable `vMAJOR.MINOR.PATCH` versions and runs the complete
-offline CI before publication. Its read-only preflight requires a clean checkout,
-the validated commit to still be the current remote `main`, and no existing tag
-for that version. It then creates the GitHub release and tag at that exact commit.
-The preflight script itself never publishes, tags, or pushes. Protocol consumers
-should pin the published version rather than a branch name.
+The workflow accepts only stable `vMAJOR.MINOR.PATCH` versions, runs CI on the
+`main` commit, then creates the version tag at that commit and its GitHub release.
+It refuses a version already tagged at another commit. Protocol consumers should
+pin the published version rather than a branch name.