[hellovai]

Summary

Hardens the baml_language release path that publishes github.com/boundaryml/baml-go to the mirror repository.

• publishes and validates the immutable exact-version runtime manifest before exposing the Go tag
• synchronizes the verified mirror artifact by checksum and asserts the module path and embedded runtime version before tagging
• requires the tag to propagate through proxy.golang.org without a direct Git fallback
• promotes the mutable canary/nightly manifest only after clean Linux, macOS, and Windows consumers load the released native runtime and execute a generated BAML call

End-user behavior

Before this change, a Go module tag could become permanently visible through the Go proxy while its required runtime manifest was absent. A same-size, same-mtime version.go could also be skipped by rsync, leaving a new tag with the preceding release's embedded fallback version.

After this change, publication proceeds in this order:

1. native assets and exact-version manifest
2. byte-verified Go mirror tag
3. public-proxy external consumer smoke tests on Linux, macOS, and Windows
4. mutable channel promotion

A failed publish or smoke leaves the previous channel release active instead of advertising an incomplete Go release.

Verification

• actionlint .github/workflows/release-baml-language.yml .github/workflows/build2-bridge-cffi.reusable.yaml
• scripts/baml-language-version check
• go test ./... and go vet ./... in baml_language/sdks/go/baml_go
• cargo test -p sdkgen_go — 84 passed
• cargo test -p baml_release — 39 passed
• clean mirror assembly plus wrong-version rejection
• dependency graph cycle/order assertion
• regression reproduction using the actual same-size, same-mtime a/b release artifact pattern

Previously published immutable tags are intentionally unchanged; the hardened guarantees apply to newly versioned releases.

Summary by CodeRabbit

• Release Process

  • Improved Go module publishing validation, including exact-version manifest checks and runtime version verification.
  • Added checksum-based synchronization checks to prevent release artifacts from drifting.
  • Channel promotion now occurs only after Go publication and smoke tests succeed.

• Reliability

  • Improved release smoke-test resilience with additional download retries.
  • Go module downloads now use the public Go proxy exclusively.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
beps	Ready	Preview, Comment	Jul 23, 2026 8:50pm
promptfiddle	Ready	Preview, Comment	Jul 23, 2026 8:50pm
promptfiddle2	Ready	Preview, Comment	Jul 23, 2026 8:50pm

[github-actions]

⏭️ Performance benchmarks were skipped

Perf benchmarks (CodSpeed) are opt-in on pull requests — they no longer run on every push. They always run automatically after merge to canary/main.

To run them on this PR, do any of the following, then push a commit (or re-run CI):

• Add RUN_CODSPEED=1 to the PR description, or
• Include run-perf or /perf in the PR title or any commit message.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a0fd7691-fd89-4b61-a86d-7ab6f91b77ca

📥 Commits

Reviewing files that changed from the base of the PR and between 4bf53a5 and 10fb269.

📒 Files selected for processing (5)

• .github/workflows/build2-bridge-cffi.reusable.yaml
• .github/workflows/release-baml-language.yml
• scripts/assemble-go-sdk-mirror
• scripts/baml-release-manifests
• scripts/smoke-go-release.py

---

📝 Walkthrough

Walkthrough

The release workflow now validates Go runtime version stamping and immutable manifests before publishing the Go module, then promotes channel metadata only after Go publishing and smoke tests succeed.

Changes

Go runtime release

Layer / File(s)	Summary
Go mirror version validation scripts/assemble-go-sdk-mirror, .github/workflows/release-baml-language.yml	The mirror assembly requires --version, validates version.go, and receives the stamped release version from the workflow.
Immutable release gating .github/workflows/release-baml-language.yml, scripts/baml-release-manifests	Go publishing waits for and validates the exact-version manifest, checks runtime stamping, and synchronizes mirror bytes by checksum.
Post-validation channel promotion .github/workflows/release-baml-language.yml, scripts/smoke-go-release.py, .github/workflows/build2-bridge-cffi.reusable.yaml	Channel promotion is deferred until Go publishing and smoke tests complete; smoke downloads use the Go proxy with six retries, and the runtime comment is updated.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant BuildGoSDK
  participant PublishPkgBoundaryML
  participant PublishGoSDK
  participant GoProxy
  participant SmokeGoRelease
  participant PublishPkgChannel
  BuildGoSDK->>PublishPkgBoundaryML: generate and upload release manifests
  PublishPkgBoundaryML->>PublishGoSDK: expose exact-version manifest prerequisite
  PublishGoSDK->>GoProxy: publish immutable Go module
  SmokeGoRelease->>GoProxy: download published module
  PublishGoSDK->>PublishPkgChannel: permit channel promotion
  SmokeGoRelease->>PublishPkgChannel: provide smoke-test success
  PublishPkgChannel->>PublishPkgChannel: upload mutable channel manifest

Loading

Possibly related PRs

• BoundaryML/baml#3694: Modifies related release workflow dependency and channel-promotion logic.
• BoundaryML/baml#4037: Overlaps with CFFI artifact manifest handling and release workflow wiring.

Suggested reviewers: 2kai2kai2, rossirpaulo

Poem

I’m a rabbit stamping versions bright,
Through manifest tunnels in moonlit flight.
Go modules hop when checks are green,
Channel flowers bloom at the final scene.
CFFI carrots rest in byte-perfect rows.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: hardening Go mirror publication in the release workflow.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/go-mirror-release-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Binary size checks passed

✅ 7 passed

	Artifact	Platform	File	Gzip	Gated on	Baseline	Delta	Status
✅	baml-cli	Linux	🔒 26.8 MB	11.4 MB	file	26.2 MB	+623.4 KB (+2.4%)	OK
✅	packed-program	Linux	🔒 17.4 MB	7.2 MB	file	17.0 MB	+353.2 KB (+2.1%)	OK
✅	baml-cli	macOS	🔒 20.8 MB	9.9 MB	file	20.3 MB	+480.3 KB (+2.4%)	OK
✅	packed-program	macOS	🔒 13.6 MB	6.3 MB	file	13.2 MB	+347.3 KB (+2.6%)	OK
✅	baml-cli	Windows	🔒 22.4 MB	10.2 MB	file	21.9 MB	+526.8 KB (+2.4%)	OK
✅	packed-program	Windows	🔒 14.5 MB	6.4 MB	file	14.2 MB	+300.5 KB (+2.1%)	OK
✅	bridge_wasm	WASM	16.4 MB	🔒 4.5 MB	gzip	4.4 MB	+66.2 KB (+1.5%)	OK

🔒 = the size this artifact is GATED on (ceiling + delta). Binaries gate on file size (installed binary); WASM gates on gzip (download size). The other size is shown for information only.

---

Generated by cargo size-gate · workflow run