chore(release): add Helm chart, Grafana dashboard, GoReleaser + workflows, changelog automation, promotion checklists, evidence harness

.githooks/pre-commit

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Markdown lint + autofix staged Markdown files
+set -euo pipefail
+
+mapfile -d '' -t _staged < <(git diff --cached --name-only --diff-filter=ACM -z)
+md_files=()
+for f in "${_staged[@]}"; do
+  [[ "$f" =~ \.(md|MD|mdx|MDX)$ ]] && md_files+=("$f")
+done
+if [[ ${#md_files[@]} -eq 0 ]]; then
+  exit 0
+fi
+
+echo "[pre-commit] markdownlint-cli2 --fix on staged Markdown files"
+if command -v npx >/dev/null 2>&1; then
+  # Run with --fix so minor issues are auto-corrected
+  npx -y markdownlint-cli2 --fix "${md_files[@]}" || true
+  # Re-stage any modified files
+  git add -- "${md_files[@]}" || true
+  # Verify no errors remain; block commit if they do
+  if ! npx -y markdownlint-cli2 "${md_files[@]}"; then
+    echo "Markdownlint errors remain after autofix. Aborting commit." >&2
+    exit 1
+  fi
+else
+  echo "npx not found. Skipping markdownlint autofix. Install Node.js to enable autofix." >&2
+fi
+
+exit 0

.github/CODEOWNERS

@@ -0,0 +1,18 @@
+# CODEOWNERS maps file patterns to required reviewers.
+# Patterns the people will be automatically requested for review.
+# See: https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default owner for entire repository
+* @flyingrobots
+
+# CI/CD and workflows
+.github/** @flyingrobots
+
+# Helm chart and deployment assets
+deploy/** @flyingrobots
+
+# Go source
+cmd/** @flyingrobots
+internal/** @flyingrobots
+test/** @flyingrobots
+

.github/workflows/changelog.yml

@@ -0,0 +1,40 @@
+name: Update Changelog
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+          ref: ${{ github.event.repository.default_branch }}
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25.x'
+      - name: Install git-chglog
+        run: go install github.com/git-chglog/git-chglog/cmd/git-chglog@v0.15.4
+      - name: Generate CHANGELOG.md
+        run: |
+          if ! $(go env GOPATH)/bin/git-chglog -o CHANGELOG.md; then
+            echo "git-chglog not configured; skipping update"; exit 0
+          fi
+      - name: Commit changes
+        run: |
+          git config user.name "github-actions"
+          git config user.email "github-actions@github.com"
+          git add CHANGELOG.md
+          git diff --cached --quiet && echo "no changes" || git commit -m "chore(changelog): update CHANGELOG for ${GITHUB_REF_NAME}"
+      - name: Push changes
+        run: |
+          git push origin HEAD:${{ github.event.repository.default_branch }} || echo "no push"

.github/workflows/ci.yml

@@ -24,7 +24,18 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.24.x'
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25.x'
+          cache: true
+      - name: Tidy
+        run: go mod download
+      - name: Govulncheck
+        uses: golang/govulncheck-action@v1
+        with:
+          go-version-input: '1.25.x'
+          vulncheck-version: 'v1.1.3'
       - name: Tidy
         run: go mod tidy
       - name: Vet
@@ -35,6 +46,15 @@ jobs:
         env:
           E2E_REDIS_ADDR: localhost:6379
         run: go test ./... -race -count=1
+      - name: E2E determinism (5x)
+        env:
+          E2E_REDIS_ADDR: 127.0.0.1:6379
+        run: |
+          set -euo pipefail
+          for i in {1..5}; do
+            echo "Run #$i"
+            go test ./test/e2e -run TestE2E_WorkerCompletesJobWithRealRedis -race -count=1
+          done
       - name: Govulncheck
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest

.github/workflows/goreleaser.yml

@@ -0,0 +1,41 @@
+name: GoReleaser
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25.x'
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          version: latest
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/markdownlint.yml

@@ -0,0 +1,21 @@
+name: Markdown Lint
+
+on:
+  pull_request:
+  push:
+    branches: [ main ]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run markdownlint-cli2
+        uses: DavidAnson/markdownlint-cli2-action@v17
+        with:
+          config: .markdownlint.yaml
+          globs: |
+            **/*.md
+            !**/node_modules/**

.github/workflows/release.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.24.x'
+          go-version: '1.25.x'
       - name: Build binary
         run: |
           make tidy
@@ -39,4 +39,3 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           generate_release_notes: true
-

.gitignore

@@ -24,10 +24,17 @@ go.work
 
 # IDE/Editor
 .idea/
-.vscode/
+# VS Code: ignore all by default, allow key shared files
+.vscode/*
+!.vscode/extensions.json
+!.vscode/settings.json
+!.vscode/launch.json
 *.swp
 *.swo
 
+# Obsidian
+.obsidian/
+
 # Logs
 *.log
 logs/

.goreleaser.yaml

@@ -0,0 +1,47 @@
+version: 2
+
+project_name: job-queue-system
+
+builds:
+  - id: job-queue-system
+    main: ./cmd/job-queue-system
+    env:
+      - CGO_ENABLED=0
+    goos: [linux, darwin, windows]
+    goarch: [amd64, arm64]
+    ldflags:
+      - -s -w -X main.version={{.Version}}
+
+archives:
+  - id: binaries
+    builds: [job-queue-system]
+    format: tar.gz
+    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    format_overrides:
+      - goos: windows
+        format: zip
+checksum:
+  name_template: "checksums_{{ .Version }}.txt"
+
+changelog:
+  sort: desc
+  use: github
+
+dockers:
+  - image_templates:
+      - ghcr.io/{{ .RepoOwner }}/{{ .RepoName }}:{{ .Version }}
+      - ghcr.io/{{ .RepoOwner }}/{{ .RepoName }}:latest
+    dockerfile: Dockerfile
+    build_flag_templates:
+      - "--pull"
+
+release:
+  github:
+    owner: '{{.Env.GITHUB_REPOSITORY_OWNER}}'
+    name: '{{.Env.GITHUB_REPOSITORY_NAME}}'
+  draft: false
+  prerelease: auto
+
+snapshot:
+  name_template: SNAPSHOT-{{ .ShortCommit }}
+

.markdownlint.yaml

@@ -0,0 +1,28 @@
+default: true
+
+# Allow long lines in docs where URLs and code blocks occur
+MD013: false
+
+# Permit duplicate headings at different levels/siblings only
+MD024:
+  siblings_only: true
+
+# Heading punctuation rules (common sentence punctuation)
+MD026:
+  punctuation: ".,;:!"
+
+# Allow first line not to be a top-level heading (some docs start with metadata)
+MD041: false
+
+# Code block style
+MD046:
+  style: fenced
+
+# Inline code spans: allow backticks in text without strict checks
+MD038: false
+
+# Ordered list item prefix flexible (allow any numbering)
+MD029: false
+
+# Allow inline HTML (used in some docs)
+MD033: false

.vscode/extensions.json

@@ -0,0 +1,6 @@
+{
+  "recommendations": [
+    "golang.go"
+  ],
+  "unwantedRecommendations": []
+}

.vscode/settings.json

@@ -0,0 +1,18 @@
+{
+  "editor.formatOnSave": false,
+  "[go]": {
+    "editor.formatOnSave": true,
+"[go]": {
+  "editor.formatOnSave": true,
+  "editor.codeActionsOnSave": {
+    "source.organizeImports": "explicit"
+  }
+},
+  },
+  "gopls": {
+    "ui.semanticTokens": true,
+    "build.experimentalWorkspaceModule": true
+  },
+  "go.testFlags": ["-race", "-count=1"],
+  "go.toolsManagement.autoUpdate": true
+}

CHANGELOG.md

@@ -3,6 +3,7 @@
 All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
+
 - Admin CLI: stats, peek, purge-dlq
 - Health/readiness endpoints
 - Queue length gauges updater
@@ -12,4 +13,3 @@ All notable changes to this project will be documented in this file.
 - Worker active gauge
 - E2E tests with Redis service in CI
 - Govulncheck in CI
-

Makefile

@@ -23,3 +23,17 @@ tidy:
 
 version:
 	@echo $(VERSION)
+
+.PHONY: hooks
+hooks:
+	@git config core.hooksPath .githooks
+	@chmod +x .githooks/pre-commit
+	@echo "Git hooks enabled (pre-commit markdownlint autofix)."
+
+.PHONY: mdlint
+mdlint:
+	@if ! command -v npx >/dev/null 2>&1; then \
+		echo "npx not found. Please install Node.js to run markdownlint."; \
+		exit 1; \
+	fi
+	@npx -y markdownlint-cli2 "**/*.md" "!**/node_modules/**"