feat(sdk-go): port Go SDK to developer-platform

.github/CODEOWNERS

@@ -5,3 +5,6 @@
 
 # Published TypeScript SDK source, packaging, and release metadata.
 /packages/sdk-typescript/** @fuller @ximt
+
+# Published Go SDK source, module metadata, and release workflow.
+/packages/sdk-go/** @fuller @ximt

.github/workflows/release-go-sdk.yml

@@ -0,0 +1,183 @@
+name: Release Go SDK
+
+on:
+  push:
+    tags:
+      - "packages/sdk-go/v*"
+      - "packages/sdk-go/websocket/gorilla/v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-go-sdk-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  minimum-go:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: packages/sdk-go
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: "1.23.x"
+          cache: false
+
+      - name: Test with minimum supported Go
+        env:
+          GOTOOLCHAIN: local
+        run: go test ./...
+
+  release:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    env:
+      # Do not allow an implicit toolchain download during a release.
+      GOTOOLCHAIN: local
+    defaults:
+      run:
+        working-directory: packages/sdk-go
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          # The generator module pins the minimum Go toolchain required by the
+          # vulnerability-fixed code generator; the SDK itself supports Go 1.23.
+          go-version-file: packages/sdk-go/scripts/go.mod
+          cache: true
+          cache-dependency-path: |
+            packages/sdk-go/go.mod
+            packages/sdk-go/go.sum
+            packages/sdk-go/websocket/gorilla/go.mod
+            packages/sdk-go/websocket/gorilla/go.sum
+            packages/sdk-go/scripts/go.mod
+            packages/sdk-go/scripts/go.sum
+            packages/sdk-go/cmd/demo/go.mod
+            packages/sdk-go/cmd/demo/go.sum
+
+      - name: Verify release tag
+        id: release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG_CREATED: ${{ github.event.created }}
+          RELEASE_TAG_FORCED: ${{ github.event.forced }}
+        run: |
+          set -euo pipefail
+
+          tag="$GITHUB_REF_NAME"
+          test "$RELEASE_TAG_CREATED" = "true"
+          test "$RELEASE_TAG_FORCED" = "false"
+
+          case "$tag" in
+            packages/sdk-go/v*)
+              module="github.com/gemini/developer-platform/packages/sdk-go"
+              ;;
+            packages/sdk-go/websocket/gorilla/v*)
+              module="github.com/gemini/developer-platform/packages/sdk-go/websocket/gorilla"
+              ;;
+            *)
+              echo "unsupported Go SDK release tag: $tag" >&2
+              exit 1
+              ;;
+          esac
+
+          version="${tag##*/}"
+          if [[ ! "$version" =~ ^v(0|1)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]]; then
+            echo "release tag must use a v0 or v1 semantic version: $tag" >&2
+            exit 1
+          fi
+
+          # Release tags must be immutable annotated tags. GitHub's tag API
+          # verifies the signature using the repository's configured signing
+          # identities; lightweight or unverified tags cannot release.
+          test "$(git cat-file -t "$tag")" = "tag"
+          tag_object="$(git rev-parse "$tag^{tag}")"
+          if ! gh api "repos/${GITHUB_REPOSITORY}/git/tags/${tag_object}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" | \
+            jq -e '.verification.verified == true and .verification.reason == "valid"' >/dev/null; then
+            echo "release tag signature is not verified by GitHub: $tag" >&2
+            exit 1
+          fi
+
+          tagged_commit="$(git rev-parse "$tag^{commit}")"
+          test "$tagged_commit" = "$GITHUB_SHA"
+
+          {
+            echo "module=$module"
+            echo "version=$version"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Verify release commit is on main
+        run: git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+
+      - name: Verify module dependencies
+        run: |
+          set -euo pipefail
+          go mod verify
+          (cd websocket/gorilla && go mod verify)
+          (cd scripts && go mod verify)
+          (cd cmd/demo && go mod verify)
+
+      - run: make test
+      - run: make race
+      - run: make vet
+      - name: Verify 32-bit wire integer decoding
+        run: GOARCH=386 go test ./generated/clearing
+      - run: make generate-check
+      - run: make release-smoke
+
+      - name: Install pinned security analyzers
+        env:
+          GOBIN: ${{ runner.temp }}/go-bin
+        run: |
+          set -euo pipefail
+          # Use immutable module revisions rather than mutable release tags.
+          go install golang.org/x/vuln/cmd/govulncheck@d1f380186385b4f64e00313f31743df8e4b89a77 # v1.1.4
+          go install github.com/securego/gosec/v2/cmd/gosec@c9453023c4e81ebdb6dde29e22d9cd5e2285fb16 # v2.22.8
+          go install honnef.co/go/tools/cmd/staticcheck@b8ec13ce4d00445d75da053c47498e6f9ec5d7d6 # 2025.1.1
+          echo "$GOBIN" >> "$GITHUB_PATH"
+
+      - name: Run security analyzers
+        run: make security
+
+      - name: Verify module is available from the public Go proxy
+        env:
+          SDK_MODULE: ${{ steps.release.outputs.module }}
+          SDK_VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          set -euo pipefail
+
+          # A newly pushed tag can take a short time to become visible through
+          # proxy.golang.org. Poll the proxy rather than silently falling back
+          # to a direct VCS fetch; this verifies the public consumer path.
+          for attempt in 1 2 3 4 5 6; do
+            if output="$(
+              GOPROXY=https://proxy.golang.org \
+              GOSUMDB=sum.golang.org \
+              GOTOOLCHAIN=local \
+              go list -m "$SDK_MODULE@$SDK_VERSION" 2>&1
+            )"; then
+              echo "$output"
+              exit 0
+            fi
+            echo "Go proxy attempt $attempt failed: $output" >&2
+            if [ "$attempt" -lt 6 ]; then
+              sleep 10
+            fi
+          done
+
+          echo "module was not available from proxy.golang.org: $SDK_MODULE@$SDK_VERSION" >&2
+          exit 1

.github/workflows/validate-go-sdk.yml

@@ -0,0 +1,90 @@
+name: Validate Go SDK
+
+on:
+  pull_request:
+    paths:
+      - "packages/sdk-go/**"
+      - ".github/workflows/validate-go-sdk.yml"
+      - ".github/workflows/release-go-sdk.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  minimum-go:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: packages/sdk-go
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: "1.23.x"
+          cache: false
+
+      - name: Test with minimum supported Go
+        env:
+          GOTOOLCHAIN: local
+        run: go test ./...
+
+  validate:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    defaults:
+      run:
+        working-directory: packages/sdk-go
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          # The generator module pins the minimum Go toolchain required by the
+          # vulnerability-fixed code generator; the SDK itself supports Go 1.23.
+          go-version-file: packages/sdk-go/scripts/go.mod
+          cache: true
+          cache-dependency-path: |
+            packages/sdk-go/go.mod
+            packages/sdk-go/go.sum
+            packages/sdk-go/websocket/gorilla/go.mod
+            packages/sdk-go/websocket/gorilla/go.sum
+            packages/sdk-go/scripts/go.mod
+            packages/sdk-go/scripts/go.sum
+            packages/sdk-go/cmd/demo/go.mod
+            packages/sdk-go/cmd/demo/go.sum
+
+      - name: Verify module dependencies
+        run: |
+          go mod verify
+          (cd websocket/gorilla && go mod verify)
+          (cd scripts && go mod verify)
+          (cd cmd/demo && go mod verify)
+
+      - run: make test
+      - run: make race
+      - run: make vet
+      - name: Verify 32-bit wire integer decoding
+        run: GOARCH=386 go test ./generated/clearing
+      - run: make generate-check
+      - run: make release-smoke
+
+      - name: Install pinned security analyzers
+        env:
+          GOBIN: ${{ runner.temp }}/go-bin
+        run: |
+          # Use immutable module revisions rather than mutable release tags.
+          go install golang.org/x/vuln/cmd/govulncheck@d1f380186385b4f64e00313f31743df8e4b89a77 # v1.1.4
+          go install github.com/securego/gosec/v2/cmd/gosec@c9453023c4e81ebdb6dde29e22d9cd5e2285fb16 # v2.22.8
+          go install honnef.co/go/tools/cmd/staticcheck@b8ec13ce4d00445d75da053c47498e6f9ec5d7d6 # 2025.1.1
+          echo "$GOBIN" >> "$GITHUB_PATH"
+
+      - name: Run security analyzers
+        run: make security

README.md

@@ -7,6 +7,7 @@ A suite of developer tools for integrating with the [Gemini](https://www.gemini.
 | Package | Description |
 |---------|-------------|
 | [`packages/mcp-server`](packages/mcp-server/) | MCP server exposing Gemini API as tools for AI assistants |
+| [`packages/sdk-go`](packages/sdk-go/) | Official Go SDK for the Gemini REST and WebSocket APIs |
 | [`samples/`](samples/) | REST and WebSocket examples in TypeScript, Python, and Go |
 | [`skills/`](skills/) | Claude Code skills (e.g., terminal candlestick charts) |
 

packages/sdk-go/Makefile

@@ -0,0 +1,57 @@
+.PHONY: all test race bench fuzz vet security fmt generate generate-check integration release-smoke
+
+all: fmt vet race bench
+
+test:
+	go test -v ./...
+	cd websocket/gorilla && go test -v ./...
+	cd scripts && go test -v ./...
+	cd cmd/demo && go test -v ./...
+
+race:
+	go test -race -v ./...
+	cd websocket/gorilla && go test -race -v ./...
+	cd scripts && go test -race -v ./...
+	cd cmd/demo && go test -race -v ./...
+
+bench:
+	go test -bench=. -benchmem ./websocket/orderbook
+
+fuzz:
+	go test -fuzz=FuzzHMAC_BuildPayload -fuzztime=5s ./auth
+	go test -fuzz=FuzzWebSocket_FrameParsing -fuzztime=5s ./websocket
+
+vet:
+	go vet ./...
+	cd websocket/gorilla && go vet ./...
+	cd scripts && go vet ./...
+	cd cmd/demo && go vet ./...
+
+security:
+	govulncheck ./...
+	# Nested modules are scanned explicitly below; excluding them here avoids
+	# treating their imports as packages in the parent module.
+	gosec -exclude-generated -exclude-dir=cmd/demo -exclude-dir=scripts -exclude-dir=websocket/gorilla ./...
+	staticcheck ./...
+	cd websocket/gorilla && govulncheck ./... && gosec -exclude-generated ./... && staticcheck ./...
+	cd scripts && govulncheck ./... && gosec -exclude-generated ./... && staticcheck ./...
+	cd cmd/demo && govulncheck ./... && gosec -exclude-generated ./... && staticcheck ./...
+
+fmt:
+	gofmt -s -w .
+	cd websocket/gorilla && gofmt -s -w .
+	cd scripts && gofmt -s -w .
+	cd cmd/demo && gofmt -s -w .
+
+generate:
+	cd scripts && go run generate.go
+
+generate-check: generate
+	git diff --exit-code generated/
+
+integration:
+	@test -n "$$GEMINI_OAUTH_ACCESS_TOKEN" || (echo "GEMINI_OAUTH_ACCESS_TOKEN is required"; exit 1)
+	cd websocket/gorilla && go test -tags=integration ./...
+
+release-smoke:
+	bash ./scripts/release_smoke.sh