Limit release workflow to tagged releases

.github/workflows/go.yml

@@ -17,9 +17,9 @@ jobs:
     - uses: actions/checkout@v4
 
     - name: Set up Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v5
       with:
-        go-version: '1.20'
+        go-version: '1.25'
 
     - name: Build
       run: go build -v ./...

.github/workflows/release.yml

@@ -2,7 +2,6 @@ name: Release
 
 on:
   push:
-    branches: [main]
     tags: ['v*']
   release:
     types: [published]
@@ -45,7 +44,7 @@ jobs:
         with:
           # Use a pinned Go version instead of parsing go.mod to avoid
           # failing on unsupported prerelease versions in the module file.
-          go-version: '1.23'
+          go-version: '1.25'
 
       - name: Download dependencies
         run: go mod download

.github/workflows/tag-on-merge.yml

@@ -0,0 +1,30 @@
+name: Tag for release on merge
+
+on:
+  push:
+    branches: ["main"]
+
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Generate tag name
+        id: tag
+        run: |
+          TAG="v$(date -u +%Y.%m.%d.%H%M%S)"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Create tag on merge commit
+        env:
+          TAG_NAME: ${{ steps.tag.outputs.tag }}
+        run: |
+          git tag "$TAG_NAME" "$GITHUB_SHA"
+          git push origin "$TAG_NAME"

go.mod

@@ -1,6 +1,6 @@
 module github.com/binsquare/envmap
 
-go 1.23
+go 1.25
 
 require (
 	github.com/1Password/connect-sdk-go v1.5.0