[tomasr78]

Moves the Go SDK to the trunk-based release flow of the other ConvertAPI SDKs (convertapi-library-php/node/python): main only, a required build check, and a GitHub Release v{semver} by tomasr78 as the only way to release.

What changes

• build.yml (replaces tests.yml): go mod verify, go mod tidy -diff, go vet, go build, go test -race on Go stable and oldstable. API tests run against https://stag-v2.convertapi.com with the CONVERTAPI_STAGING_TOKEN secret (Actions + Dependabot); without it they skip and the offline tests still run. The build job aggregates the matrix (a skipped required check would count as passed) and checks config.Version is SemVer, v0/v1 (no /vN module path) and not behind the latest tag.
• release.yml: on a published Release, checks the publisher and the re-run actor, SemVer tag, major version vs module path, pre-release tick, tag on main, config.Version == tag; runs every test against staging; then go mod download <module>@<tag> through proxy.golang.org (verified by sum.golang.org) and checks the proxy's origin commit is the tag's; asks pkg.go.dev to fetch the version (warning only). No registry keys: a Go version is the tag.
• Tests: offline tests against an httptest fake API (upload → convert → download, user info, error body, headers); the live tests skip without CONVERTAPI_TOKEN.
• Library: config.Version = "1.0.0" (was the number 4) in the User-Agent; config.New(token, url, nil) no longer panics (typed-nil *http.Transport) and sets CaTransport; go vet copylocks fix in param.NewFile.
• RELEASING.md, CHANGELOG.md, Dependabot (actions + gomod), README install snippet go get github.com/ConvertAPI/convertapi-go@v1.0.0.

Module path

Stays github.com/ConvertAPI/convertapi-go (the repo's old name, served via GitHub's redirect), which every existing user imports. Changing it would break all of them. v1.0.0 needs no /vN suffix. The unmerged v3 branch (API v3, renamed types/functions) is a breaking change and would ship as v2.0.0 with module path .../convertapi-go/v2; RELEASING.md describes it.

Verified locally (golang:1.27 and 1.26 containers): vet, build, tidy, and all 7 tests pass, including the 3 live ones against stag-v2.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

Release checks need fixes, and permanent publication depends on repository controls that require human validation.

2 open issues

• Prerelease tags allow version regression due to incomplete SemVer comparison · New
• Uppercase prerelease tags are not case-encoded in proxy URLs · New

What changed in this PR

Moves the Go SDK to trunk-based releases for v1.0.0 while preserving its existing module path.

Changes:

• Adds build validation, release verification, and dependency updates.
• Adds offline tests and makes live tests staging-aware.
• Fixes configuration and mutex-copy issues; updates release documentation.

File	Description
RELEASING.md	Documents release procedures and module compatibility.
README.md	Updates installation, imports, badges, and links.
pkg/​param/​file.go	Avoids copying a mutex.
pkg/​config/​version.go	Sets the version string to 1.0.0.
pkg/​config/​transport.go	Updates User-Agent version formatting.
pkg/​config/​config.go	Handles nil defaults and initializes transport fields.
offline_test.go	Adds fake-API and configuration tests.
convert_test.go	Configures and conditionally skips live tests.
CHANGELOG.md	Records v1.0.0 changes.
.github/​workflows/​tests.yml	Removes the previous test workflow.
.github/​workflows/​release.yml	Validates releases and requests proxy publication.
.github/​workflows/​build.yml	Adds Go matrix testing and version checks.
.github/​dependabot.yml	Schedules action and Go dependency updates.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Release concurrency needs correction, and the irreversible release process relies on external protection settings requiring human verification.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Prevent pending releases from canceling each other

.github/​workflows/​release.yml:40

This shared concurrency group keeps only one pending job, even with cancel-in-progress: false. If a release is running and two more are published, the newer pending job cancels the older one. That already-public version then misses validation and proxy fetching unless someone re-runs it. Include the release tag in the group so different versions cannot cancel each other's pending jobs.

2 resolved since last review

• Uppercase prerelease tags are not case-encoded in proxy URLs
• Prerelease tags allow version regression due to incomplete SemVer comparison

_{Review effort: Balanced}