chore(sdk-go): add repository scaffold, CI, and DCO

Apache 2.0 Tier-1 Go SDK shell matching Node/Python SDK repos.
No implementation yet; CI skips tests until Go sources land.

Signed-off-by: Nathan Gillett <nathan@intentproof.io>

Author: Nathan Gillett

.github/workflows/ci.yml

@@ -0,0 +1,29 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build-test:
+    name: "IntentProof CI: Build and Test"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+
+      - name: Verify module metadata
+        run: go mod verify
+
+      - name: Run tests
+        run: |
+          if [ -z "$(find . -name '*.go' -not -path './.git/*')" ]; then
+            echo "No Go source files found (project scaffold only)"
+            exit 0
+          fi
+          go test ./...

.github/workflows/dco.yml

@@ -0,0 +1,41 @@
+name: dco
+
+on:
+  pull_request:
+
+jobs:
+  check:
+    name: "IntentProof CI: DCO"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Require Signed-off-by trailer on every commit
+        run: |
+          base="${{ github.event.pull_request.base.sha }}"
+          head="${{ github.event.pull_request.head.sha }}"
+          fail=0
+          for sha in $(git rev-list "$base".."$head"); do
+            body=$(git log -1 --format=%B "$sha")
+            author_email=$(git log -1 --format=%ae "$sha")
+            soby=$(echo "$body" | grep -oE '^Signed-off-by: .+ <.+@.+>$' || true)
+            if [ -z "$soby" ]; then
+              echo "Commit $sha is missing a Signed-off-by trailer." >&2
+              fail=1
+            else
+              soby_email=$(echo "$soby" | grep -oE '<.+@.+>' | tr -d '<>')
+              if [ "$soby_email" != "$author_email" ]; then
+                echo "Commit $sha: Signed-off-by email ($soby_email) does not match author email ($author_email)." >&2
+                fail=1
+              fi
+            fi
+          done
+          if [[ $fail -ne 0 ]]; then
+            echo "" >&2
+            echo "All commits in this PR must be signed off via the DCO." >&2
+            echo "See CONTRIBUTING.md. Use 'git commit -s' or amend with 'git commit --amend -s'." >&2
+            exit 1
+          fi
+          echo "PASS: all commits carry Signed-off-by trailers."

.github/workflows/release-signing-dry-run.yml

@@ -0,0 +1,82 @@
+name: release signing dry run
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_version:
+        description: SemVer version to place in dry-run attestations.
+        required: true
+        default: 0.0.0-dryrun
+        type: string
+      release_ref:
+        description: Git ref to check out for the dry run.
+        required: true
+        default: refs/heads/main
+        type: string
+
+jobs:
+  build-go-module:
+    name: "IntentProof Release: Build Go Module Archive"
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    outputs:
+      artifact_paths: ${{ steps.archive.outputs.artifact_paths }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          ref: ${{ inputs.release_ref }}
+
+      - uses: actions/setup-go@40b3466c64957d331b6193b26c7cd62c6e411fd6
+        with:
+          go-version: '1.25'
+
+      - name: Verify module metadata
+        run: go mod verify
+
+      - name: Run tests
+        run: |
+          if [ -z "$(find . -name '*.go' -not -path './.git/*')" ]; then
+            echo "No Go source files found (project scaffold only)"
+            exit 0
+          fi
+          go test ./...
+
+      - name: Package module source archive
+        run: |
+          mkdir -p dist
+          tar czf "dist/intentproof-sdk-go-${{ inputs.release_version }}.tar.gz" \
+            go.mod LICENSE NOTICE README.md CONTRIBUTING.md SECURITY.md
+
+      - name: Export archive paths
+        id: archive
+        run: |
+          {
+            echo 'artifact_paths<<EOF'
+            find dist -maxdepth 1 -type f | sort
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: go-release-dry-run
+          path: dist/*
+
+  sign-go-module:
+    name: "IntentProof Release: Sign Go Module Archive"
+    needs: build-go-module
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+      packages: write
+    uses: IntentProof/intentproof-tools/.github/workflows/release-build-sign.yml@317387a9724787e4ac484f39de46d7e559b6c98d
+    with:
+      artifact_kind: generic
+      subject_name: intentproof-sdk-go
+      release_version: ${{ inputs.release_version }}
+      release_ref: ${{ inputs.release_ref }}
+      artifact_paths: ${{ needs.build-go-module.outputs.artifact_paths }}
+      artifact_download_name: go-release-dry-run
+      artifact_download_path: dist
+      attest_to_rekor: false

.gitignore

@@ -0,0 +1,19 @@
+# Binaries
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test / coverage
+*.test
+*.out
+coverage.out
+coverage.html
+
+# Build output
+/bin/
+/dist/
+
+# Editor / OS
+.DS_Store

CONTRIBUTING.md

@@ -0,0 +1,48 @@
+# Contributing to intentproof-sdk-go
+
+Thanks for your interest in IntentProof.
+
+## Issues welcome
+
+Please report bugs, API gaps, and conformance findings via
+[GitHub Issues](https://github.com/IntentProof/intentproof-sdk-go/issues).
+That is the primary way to help right now.
+
+We do **not** accept unsolicited pull requests from outside the
+maintainer team. If you are a customer or partner with a change that
+must land upstream, contact IntentProof, Inc. before opening a PR.
+
+Maintainer commits use the Developer Certificate of Origin (DCO) below.
+
+## Developer Certificate of Origin (DCO)
+
+Merged commits in this repository use the
+[Developer Certificate of Origin 1.1](https://developercertificate.org/).
+
+Every commit must carry a `Signed-off-by:` trailer matching the
+author email. The easiest way to do this is to pass `-s` to `git
+commit`:
+
+```bash
+git commit -s -m "..."
+```
+
+You can also retroactively sign off the last commit with:
+
+```bash
+git commit --amend --no-edit -s
+```
+
+Then force-push the amended branch:
+
+```bash
+git push --force-with-lease
+```
+
+Commits that do not include a valid `Signed-off-by` trailer will
+be rejected by CI.
+
+## License
+
+By contributing as a maintainer, you agree your commits are licensed
+under the Apache License 2.0 (see `LICENSE`).