From 548d478eb7a544a416e6bbfabdbf5b607291dd3f Mon Sep 17 00:00:00 2001
From: Joshua Temple <joshua.temple@stablekernel.com>
Date: Sun, 23 Aug 2026 04:47:48 -0400
Subject: [PATCH] ci(release): validate modules standalone (GOWORK=off) and
 lint on the newest Go leg only

The first source-module tags exposed two latent release-workflow issues:

- source/kafka is deliberately excluded from go.work, but the validate job
  ran with the root workspace present, so 'go test ./...' inside the module
  failed on every leg ('directory prefix . does not contain modules listed
  in go.work'). Set GOWORK=off for the whole gate: released modules must
  build standalone anyway; replace directives carry intra-repo deps.
- golangci-lint is compiled by the active toolchain; on the go1.25 legs it
  refused a module whose toolchain directive targets a newer language
  version ('can't load config: the Go language version (go1.25) used to
  build golangci-lint is lower than the targeted Go version (1.26.4)').
  Lint now runs on the 1.26.6 leg only; test -race still covers 1.25.x.

Also adds [1.0.1] release-engineering entries to both source changelogs:
the v1.0.0 tags stay immutable; v1.0.1 republishes the identical source.
---
 .github/workflows/release.yml | 10 ++++++++++
 source/CHANGELOG.md           |  8 ++++++++
 source/kafka/CHANGELOG.md     |  8 ++++++++
 3 files changed, 26 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bf3ea2c..06b252c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -64,6 +64,11 @@ jobs:
     env:
       MODULE: ${{ needs.resolve.outputs.module }}
       THRESHOLD: "80"
+      # Every released module must build standalone: SDK-backed modules like
+      # source/kafka are deliberately excluded from go.work, so building them
+      # with the root workspace present fails outright. Disable the workspace
+      # for the whole gate; replace directives cover intra-repo dependencies.
+      GOWORK: "off"
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -80,7 +85,12 @@ jobs:
       - name: govulncheck
         working-directory: ${{ env.MODULE }}
         run: go run "$GOVULNCHECK" ./...
+      # Lint runs only on the newest Go leg: golangci-lint is compiled by the
+      # active toolchain, and an older one (go1.25) refuses a module targeting
+      # a newer language version (module toolchain directives), which would
+      # fail the 1.25.x legs spuriously. Test -race still covers those legs.
       - name: golangci-lint
+        if: matrix.go == '1.26.6'
         working-directory: ${{ env.MODULE }}
         run: go run "$GOLANGCI_LINT" run --config "$GITHUB_WORKSPACE/.golangci.yml" ./...
       - name: coverage gate
diff --git a/source/CHANGELOG.md b/source/CHANGELOG.md
index 5adb7ca..53689c5 100644
--- a/source/CHANGELOG.md
+++ b/source/CHANGELOG.md
@@ -5,6 +5,14 @@ All notable changes to `crucible/source` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.1] — 2026-08-23
+
+Release engineering only: no code changes. The v1.0.0 tag's release workflow
+failed for environment reasons (the validate job built with the repository
+workspace present, and golangci-lint could not run on the Go 1.25 matrix leg
+against a module targeting a newer language version); v1.0.1 republishes the
+identical source so the tag validates cleanly end to end.
+
 ## [1.0.0] — 2026-08-23
 
 The first stable release. It freezes the neutral ingress surface — `Inlet`,
diff --git a/source/kafka/CHANGELOG.md b/source/kafka/CHANGELOG.md
index 324fa36..7a9ce0d 100644
--- a/source/kafka/CHANGELOG.md
+++ b/source/kafka/CHANGELOG.md
@@ -5,6 +5,14 @@ All notable changes to `crucible/source/kafka` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.1] — 2026-08-23
+
+Release engineering only: no code changes. The v1.0.0 tag's release workflow
+failed for environment reasons (the validate job built with the repository
+workspace present, and golangci-lint could not run on the Go 1.25 matrix leg
+against a module targeting a newer language version); v1.0.1 republishes the
+identical source so the tag validates cleanly end to end.
+
 ## [1.0.0] — 2026-08-23
 
 The first stable release. It freezes the adapter surface — `Inlet` with `New`