Release tooling supports sequential release candidates

.github/workflows/actions.lock

@@ -11,7 +11,6 @@ workflows:
         - 'actions/dependency-review-action@v4.9.0'
     '.github/workflows/release.yml':
         - 'actions/checkout@v4.3.1'
-        - 'actions/setup-go@v5.6.0'
 dependencies:
     'actions/checkout@v4.3.1':
         ref: 'v4.3.1'

.github/workflows/release.yml

@@ -3,47 +3,46 @@
 name: Release
 
 on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: Version bump for the Go module (go/vX.Y.Z tag)
-        type: choice
-        required: true
-        default: patch
-        options:
-          - patch
-          - minor
-          - major
+  push:
+    tags:
+      - go/v*
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
-  group: release
+  group: release-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
-  release:
-    name: Cut go/ release
+  publish:
+    name: Publish
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
-      - name: Guard release branch
-        if: github.ref != 'refs/heads/main'
-        run: |
-          echo "::error::Releases must be cut from main (got $GITHUB_REF)."
-          exit 1
-
       - uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
           fetch-tags: true
 
-      - uses: actions/setup-go@v5.6.0
-        with:
-          go-version: '1.19'
-          cache-dependency-path: go/go.sum
+      - name: Verify tag
+        id: tag
+        run: |
+          script/verify-release-tag "$GITHUB_REF_NAME" go/v
+          echo "version=${GITHUB_REF_NAME#go/}" >>"$GITHUB_OUTPUT"
 
-      - name: Release
+      - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: script/release "${{ inputs.bump }}"
+        run: |
+          args=()
+          if [[ "$GITHUB_REF_NAME" == *-rc.* ]]; then
+            args+=(--prerelease)
+          fi
+          gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --verify-tag --generate-notes "${args[@]}"
+
+      - name: Warm Go proxy
+        run: |
+          curl -fsSL "https://proxy.golang.org/github.com/github/actions-lockfile/go/@v/${{ steps.tag.outputs.version }}.info" >/dev/null ||
+            echo "::warning::Go proxy warm failed; the proxy will fetch on first use."

Makefile

@@ -5,6 +5,7 @@ generate:
 
 test:
 	cd go && go test ./... -count=1
+	script/release_test
 
 lint:
 	cd go && go vet ./...

RELEASING.md

@@ -7,33 +7,39 @@ standalone module so consumers can import it on its own.
 
 ## Cutting a release
 
-Releases are cut by CI, not from a maintainer's laptop. Open the **Actions**
-tab, run the **Release** workflow from `main`, and choose a bump:
+From a clean, current `main`, preview the next release:
 
-- **patch** — backward-compatible fixes
-- **minor** — backward-compatible additions
-- **major** — breaking changes (see the version-suffix caveat below)
-
-CI runs `script/release`, which regenerates and verifies the tree, runs the
-full build, computes the next version from the latest `go/vX.Y.Z` tag, pushes
-the tag, cuts a GitHub Release with generated notes, and warms the Go module
-proxy. The first release has no prior tag, so it bases off `v0.0.0` — pick
-**minor** to land on `v0.1.0`.
+```sh
+RELEASE_DRY_RUN=1 script/release patch
+```
 
-`script/release` is the single source of truth and runs locally too. Preview
-without touching anything:
+Then cut it:
 
 ```sh
-RELEASE_DRY_RUN=1 script/release minor
+script/release patch
 ```
 
+Append `--rc` to preview or cut a release candidate, for example
+`script/release patch --rc`. Repeating the same bump increments `-rc.N`; omit
+`--rc` to release the stable version.
+
+Use `patch` for compatible fixes, `minor` for compatible additions, and
+`major` for breaking changes.
+
+The script validates the repository, checks the current branch and
+`origin/main`, then pushes and verifies an annotated `go/vX.Y.Z[-rc.N]` tag.
+
+The tag workflow verifies the tag, then creates the GitHub Release and warms
+the Go module proxy.
+
 ## Tag conventions
 
 The Go sub-module uses path-prefixed semver tags, per Go's multi-module
 repository rules:
 
 ```
 go/v0.1.0
+go/v0.1.1-rc.1
 go/v0.1.1
 go/v1.0.0
 ```
@@ -51,7 +57,7 @@ release script refuses to mint such a tag until `go.mod` carries the suffix.
 
 Shared lockfile invariants live outside language implementations:
 
-- `schema/lockfile-v0.0.1.json` is the published schema.
+- `schema/lockfile-vX.Y.Z.json` files are the published schemas.
 - `go/pkg/lockfile/schema_gen.go` is generated from the root schema for Go
   consumers. Run `make generate` after schema changes; Go tests enforce that
   the generated value still matches the root schema.