Prepare source release validation

scripts/release-check.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repository_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$repository_dir"
+
+baseline_toolchain=${CONFIGKIT_BASELINE_TOOLCHAIN:?set CONFIGKIT_BASELINE_TOOLCHAIN to a cached supported Go 1.25 patch release}
+newer_toolchain=${CONFIGKIT_NEWER_TOOLCHAIN:?set CONFIGKIT_NEWER_TOOLCHAIN to a cached newer supported Go toolchain}
+
+run_go() {
+  local toolchain=$1
+  shift
+  GOTOOLCHAIN="$toolchain" GOPROXY=off go "$@"
+}
+
+check_toolchain() {
+  local toolchain=$1
+  GOTOOLCHAIN="$toolchain" GOPROXY=off go version >/dev/null
+  run_go "$toolchain" mod download
+}
+
+check_toolchain "$baseline_toolchain"
+check_toolchain "$newer_toolchain"
+bash -n scripts/release-check.sh
+
+temporary_dir=$(mktemp -d)
+trap 'rm -rf -- "$temporary_dir"' EXIT
+git ls-files --cached --others --exclude-standard -z |
+  tar --null --files-from=- --create --file=- |
+  tar --extract --file=- --directory="$temporary_dir"
+(
+  cd "$temporary_dir"
+  GOTOOLCHAIN="$baseline_toolchain" GOPROXY=off go mod tidy
+)
+diff -u go.mod "$temporary_dir/go.mod"
+diff -u go.sum "$temporary_dir/go.sum"
+
+mapfile -d '' go_files < <(git ls-files --cached --others --exclude-standard -z -- '*.go')
+if ((${#go_files[@]})); then
+  unformatted=$(gofmt -l -- "${go_files[@]}")
+  if [[ -n "$unformatted" ]]; then
+    printf 'gofmt required for:\n%s\n' "$unformatted" >&2
+    exit 1
+  fi
+fi
+
+git diff --check HEAD --
+while IFS= read -r -d '' candidate_file; do
+  case "$candidate_file" in
+    *.go|*.md|*.sh|go.mod|go.sum|LICENSE|.gitignore|AGENTS.md)
+      if LC_ALL=C grep -nE '[[:blank:]]+$' -- "$candidate_file"; then
+        printf 'trailing whitespace found in %s\n' "$candidate_file" >&2
+        exit 1
+      fi
+      ;;
+  esac
+done < <(git ls-files --cached --others --exclude-standard -z)
+
+for toolchain in "$baseline_toolchain" "$newer_toolchain"; do
+  run_go "$toolchain" test ./...
+  run_go "$toolchain" vet ./...
+  run_go "$toolchain" build ./...
+done
+
+run_go "$newer_toolchain" test -race ./...
+run_go "$newer_toolchain" test . -run '^Example'
+run_go "$newer_toolchain" test ./examples/consumers
+run_go "$newer_toolchain" test . -run '^TestLocalDocumentationLinks$'
+run_go "$newer_toolchain" test . -run '^TestDependencyImportBoundary$'
+
+for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
+  target_os=${target%/*}
+  target_arch=${target#*/}
+  GOTOOLCHAIN="$newer_toolchain" GOPROXY=off CGO_ENABLED=0 GOOS="$target_os" GOARCH="$target_arch" go build ./...
+done