ci(release): allow the Go SDK tag to be dispatched individually

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

.github/workflows/release-publish.yml

@@ -549,37 +549,16 @@ jobs:
       npm-version: ${{ inputs.npm-version }}
       make-latest: ${{ inputs.make-latest }}
 
-  # Go resolves submodule versions from directory-prefixed tags, so the SDK at
-  # sdk/go needs its own sdk/go/vX.Y.Z tag to show up as a release on pkg.go.dev.
   tag-sdk-go:
     name: Tag Go SDK
     needs: release
     if: ${{ !inputs.is-prerelease }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
     permissions:
       contents: write
-    env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      VERSION: ${{ inputs.semver }}
-      SOURCE_SHA: ${{ inputs.source-sha }}
-    steps:
-      - name: Create Go SDK tag
-        run: |
-          set -euo pipefail
-          tag="sdk/go/v${VERSION}"
-          # Lightweight tag, so the ref points at the commit directly.
-          if ! existing=$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${tag}" --jq .object.sha 2>/dev/null); then
-            gh api "repos/${GITHUB_REPOSITORY}/git/refs" -f ref="refs/tags/${tag}" -f sha="${SOURCE_SHA}"
-          elif [[ "${existing}" != "${SOURCE_SHA}" ]]; then
-            echo "${tag} already exists at ${existing}, expected ${SOURCE_SHA}" >&2
-            exit 1
-          fi
-
-      # pkg.go.dev picks up versions the Go module proxy has fetched.
-      - name: Request version from Go module proxy
-        continue-on-error: true
-        run: curl --fail --silent --show-error --max-time 60 "https://proxy.golang.org/github.com/!n!v!i!d!i!a/!open!shell/sdk/go/@v/v${VERSION}.info"
+    uses: ./.github/workflows/sdk-go-tag.yml
+    with:
+      version: ${{ inputs.semver }}
+      source-sha: ${{ inputs.source-sha }}
 
   trigger-wheel-publish:
     name: Trigger Wheel Publish

.github/workflows/sdk-go-tag.yml

@@ -0,0 +1,58 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Go resolves submodule versions from directory-prefixed tags, so the SDK at
+# sdk/go needs its own sdk/go/vX.Y.Z tag to show up as a release on pkg.go.dev.
+name: Tag Go SDK
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+      source-sha:
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Release version without the v prefix, e.g. 0.1.6
+        required: true
+        type: string
+      source-sha:
+        description: Commit the stable tag points to
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    name: Tag Go SDK
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      VERSION: ${{ inputs.version }}
+      SOURCE_SHA: ${{ inputs.source-sha }}
+    steps:
+      - name: Create Go SDK tag
+        shell: bash
+        run: |
+          set -euo pipefail
+          tag="sdk/go/v${VERSION}"
+          # Lightweight tag, so the ref points at the commit directly.
+          if ! existing=$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${tag}" --jq .object.sha 2>/dev/null); then
+            gh api "repos/${GITHUB_REPOSITORY}/git/refs" -f ref="refs/tags/${tag}" -f sha="${SOURCE_SHA}"
+          elif [[ "${existing}" != "${SOURCE_SHA}" ]]; then
+            echo "${tag} already exists at ${existing}, expected ${SOURCE_SHA}" >&2
+            exit 1
+          fi
+
+      # pkg.go.dev picks up versions the Go module proxy has fetched.
+      - name: Request version from Go module proxy
+        continue-on-error: true
+        shell: bash
+        run: curl --fail --silent --show-error --max-time 60 "https://proxy.golang.org/github.com/!n!v!i!d!i!a/!open!shell/sdk/go/@v/v${VERSION}.info"

CI.md

@@ -720,6 +720,7 @@ These workflows run after merge to publish dev/tagged artifacts and verify them.
 | `.github/workflows/snap-package.yml` | Builds snap and component artifacts for Release Dev, Release, and Pre-release without Store credentials or publication. |
 | `.github/workflows/snap-publish.yml` | Uploads existing snap and component artifacts directly to a Store channel without rebuilding. Release Dev uses `latest/edge`, Pre-release uses `latest/beta`, and Release uses `latest/stable` for the stable rebuild. Uploads queue per channel and architecture, so tagged beta and stable jobs recheck repository tags after earlier publication finishes and before updating their floating channels. Manual dispatch uploads the `snap-linux-*` artifacts from `artifact-run-id`. |
 | `.github/workflows/sdk-typescript-publish.yml` | Publishes the TypeScript SDK to GitHub Packages. Called by stable Release; manual dispatch publishes a given tag and npm version. |
+| `.github/workflows/sdk-go-tag.yml` | Creates the `sdk/go/vX.Y.Z` tag and asks the Go module proxy to fetch it. Called by stable Release; manual dispatch tags a given version and commit. |
 | `.github/workflows/wheel-publish.yml` | Triggers the GitLab pipeline that publishes wheels from a GitHub Release to PyPI. Called by stable Release; manual dispatch republishes a given tag. |
 | `.github/workflows/release-canary.yml` | Smoke-tests published dev artifacts in the `macos`, `ubuntu-deb`, `ubuntu-snap-system-docker`, `fedora`, and `kubernetes` (kind + Helm) jobs. Each job reaches its gateway and creates, exercises, and deletes a sandbox. The `ubuntu-snap-system-docker` job verifies a compatible system Docker lifecycle, while `ubuntu-snap-docker-preflight` tests fail-fast behavior when Docker is absent or supplied by the Docker snap. The positive snap lane also runs a local policy containment check with the packaged prover. It runs automatically after `Release Dev` succeeds and supports manual dispatch (`gh workflow run release-canary.yml --ref <branch>`). See the `test-release-canary` skill for the playbook and local kind reproduction. |