Repository navigation
Add a release process and a first version tag for the Go module #1034
Description
The Go module in this repository has no release process. Go users can only depend on a commit, not on a version.
The module has no version tag
The module is github.com/cipherstash/stack/languages/golang. It holds the stackauth and stackencrypt packages, which wrap two WASI guest modules built from the Rust crates. It came to this repository on 2 October 2026.
Go finds a module's versions from git tags. For a module in a subfolder, the tag must start with the folder's path, for example languages/golang/v0.1.0. No tag like that exists, so go get can only resolve a pseudo-version for a commit.
What needs deciding
- The first version, and how the version moves. Should it follow the Rust crates, or move on its own?
- The embedded guest modules. The packages embed WASI modules built from Rust. A release has to build those modules from the tagged commit, and check that they match the committed copies.
- Who makes the tag. It could be a release workflow, such as release-plz or a changeset, or a person.
- How to publish the release. For example, a GitHub release with notes, and a check that
pkg.go.devlists the version.
Done when
- There is a written release process for the Go module.
- The first version tag exists, and
go get github.com/cipherstash/stack/languages/golang@<version>works.
Activity
ci(golang): tag Go module releases with their WASI guests
ci(golang): tag Go module releases with their WASI guests
ci(golang): tag Go module releases with their WASI guests
ci(golang): keep the release token out of the build and check version…
docs(golang): give the Go module its own MIT licence file
test(ci): hold the Go release's non-publishing jobs read-only
ci(golang): tag Go module releases with their WASI guests
ci(golang): keep the release token out of the build and check version…
docs(golang): give the Go module its own MIT licence file
test(ci): hold the Go release's non-publishing jobs read-only
coderdan commentedon Oct 12, 2026
#1173 tracks one gap left in the release workflow from #1167: it doesn't check that
tests-golang.ymlpassed before tagging.coderdan commentedon Oct 19, 2026
Both "done when" conditions hold. The release process is written in
AGENTS.md("Repository Layout", thelanguages/golangentry:gh workflow run release-golang.yml -f version=X.Y.Z[-pre] --ref <branch>, the guest build, the release-only commit, the tag, the attached EQL v4 bundle, and why a tag is never moved) and implemented by.github/workflows/release-golang.yml(#1167). The first tag exists,languages/golang/v0.1.0-alpha.1, and the Go proxy lists it:https://proxy.golang.org/github.com/cipherstash/stack/languages/golang/@v/listreturnsv0.1.0-alpha.1, sogo get github.com/cipherstash/stack/languages/golang@v0.1.0-alpha.1resolves. The one gap left in the workflow, tagging beforetests-golang.ymlhas passed, stays tracked in #1173.