release-sidecar

# Releasing a New Version Operator contract: **`docs/guides/active/releasing.md`**. Enforcement lives in `scripts/` and `BUMP=minor make release` (or `RELEASE_VERSION=vX.Y.Z make release` for an explicit version). Prefer the one-shot command over replaying this checklist by hand. ## Prerequisites - Go matching `go.mod` - Clean working tree; `main` identical to live `origin/main` - Tests and **Go CI** green on the commit you will tag (tests *and* lint) — `check-release-state.sh` now checks this itself via `gh run list --workflow=go-ci.yml` and fails closed if it's red/running/missing, so you don't have to remember to look - GitHub CLI authenticated with push access to `marcus/homebrew-tap` - No `replace` directives in `go.mod` - `HOMEBREW_TAP_TOKEN` secret present in the GitHub repo (CI tap job) **Beware of go.work**: always use `GOWORK=off` when updating dependencies and when validating install paths. Local lint must match CI's golangci-lint **v2.12.2**, or trust CI: ```bash gh run list --workflow=go-ci.yml --limit=1 ``` ## Prepare (sidecar-specific) ### 1. Version ```bash git tag -l 'v*' | sort -V | tail -1 ``` SemVer: major / minor / patch as usual. ### 2. Sibling dependencies (td, tasks) ```bash make sync-deps # pins every github.com/marcus/* requirement to its latest tag ``` `check-release-state.sh` enforces this and refuses to tag when one is behind. `go.work` resolves those imports to the local checkouts, so drift is invisible locally — both the gat...