fix(sdk): address v3 Go SDK review findings

- disable setup-go caching in the SDK release workflow (zizmor cache-poisoning gate)
- cover api/v3/client in make mod and make lint-go
- fail fast on discriminated unions with non-model variants in typespec-go
- add wire-level query serialization tests for filters and scalar params

Author: tothandras

.github/workflows/release-go-sdk.yaml

@@ -39,13 +39,11 @@ jobs:
         with:
           persist-credentials: false
 
-      # The SDK module is pure Go (no cgo/librdkafka), so plain setup-go is
-      # enough here; the Nix shell is not needed.
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: api/v3/client/go.mod
-          cache-dependency-path: api/v3/client/go.sum
+          cache: false
 
       - name: Run Go SDK checks
         run: make test-go-sdk

Makefile

@@ -293,6 +293,7 @@ package-helm-chart: ## Package a helm chart for release (set CHART and VERSION)
 lint-go: ## Lint Go code
 	$(call print-target)
 	golangci-lint run -v $(GO_LINT_PATH)
+	cd api/v3/client && golangci-lint run -v ./...
 	go vet -C e2e ./...
 	cd e2e && golangci-lint run -v ./...
 
@@ -327,6 +328,7 @@ mod: ## go mod tidy
 	$(call print-target)
 	go mod tidy
 	go mod tidy -C collector
+	go mod tidy -C api/v3/client
 	go mod tidy -C e2e
 
 .PHONY: seed

api/spec/packages/typespec-go/src/components/GoUnion.tsx

@@ -36,6 +36,23 @@ export function GoUnion({ program, union, name, mode, doc }: GoUnionProps) {
       `typespec-go: union ${name} has multiple object variants but no discriminator; add @discriminated so Go accessors can select variants safely`,
     )
   }
+  // The discriminated path assumes every selectable variant is a model: the
+  // From* constructors envelope the payload under the discriminator property
+  // and the As* accessors match on it. A scalar or enum variant has neither,
+  // so it would emit constructors/accessors that cannot round-trip.
+  if (discriminator) {
+    const nonModelVariants = [...union.variants.values()].filter(
+      (variant) =>
+        variant.type.kind !== 'Model' && variant.type.kind !== 'Intrinsic',
+    )
+    if (nonModelVariants.length > 0) {
+      throw new Error(
+        `typespec-go: discriminated union ${name} mixes model and non-model variants (${nonModelVariants
+          .map((variant) => variant.type.kind)
+          .join(', ')}); only model variants can carry the discriminator`,
+      )
+    }
+  }
   const variants = [...union.variants.values()].flatMap((variant) => {
     if (variant.type.kind === 'Intrinsic') {
       return []

api/v3/client/errors_test.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/openmeterio/openmeter/api/v3/client"
+	openmeter "github.com/openmeterio/openmeter/api/v3/client"
 )
 
 func TestAPIErrorParsesRFC7807(t *testing.T) {

api/v3/client/query_test.go

@@ -0,0 +1,52 @@
+// Hand-written query-serialization tests for the generated OpenMeter Go SDK.
+// The generator's output cleaner preserves *_test.go files, so these survive
+// regeneration. The recorder harness lives in transport_test.go.
+package openmeter_test
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	openmeter "github.com/openmeterio/openmeter/api/v3/client"
+)
+
+func TestFilterQuerySerialization(t *testing.T) {
+	t.Parallel()
+
+	rec := &requestRecorder{}
+	om := newTestClient(t, rec.handler(http.StatusOK, emptyPageBody))
+
+	params := openmeter.MeterListParams{Filter: &openmeter.MeterFilter{
+		Key:  &openmeter.StringFilter{Oeq: []string{"tokens", "requests"}},
+		Name: &openmeter.StringFilter{Contains: openmeter.String("gpt")},
+	}}
+	if _, err := om.Meters.List(t.Context(), params); err != nil {
+		t.Fatalf("Meters.List: %v", err)
+	}
+
+	q := rec.last(t).query
+	if got := q.Get("filter[key][oeq]"); got != "tokens,requests" {
+		t.Errorf("filter[key][oeq] = %q, want %q", got, "tokens,requests")
+	}
+	if got := q.Get("filter[name][contains]"); got != "gpt" {
+		t.Errorf("filter[name][contains] = %q, want %q", got, "gpt")
+	}
+}
+
+func TestScalarQueryParamSerialization(t *testing.T) {
+	t.Parallel()
+
+	rec := &requestRecorder{}
+	om := newTestClient(t, rec.handler(http.StatusOK, "{}"))
+
+	timestamp := time.Date(2026, 5, 11, 10, 30, 0, 0, time.UTC)
+	params := openmeter.GetCustomerCreditBalanceParams{Timestamp: openmeter.Time(timestamp)}
+	if _, err := om.Customers.Credits.Balance.Get(t.Context(), "cus-1", params); err != nil {
+		t.Fatalf("Customers.Credits.Balance.Get: %v", err)
+	}
+
+	if got := rec.last(t).query.Get("timestamp"); got != "2026-05-11T10:30:00Z" {
+		t.Errorf("timestamp = %q, want %q", got, "2026-05-11T10:30:00Z")
+	}
+}

api/v3/client/transport_test.go

@@ -14,7 +14,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/openmeterio/openmeter/api/v3/client"
+	openmeter "github.com/openmeterio/openmeter/api/v3/client"
 )
 
 const emptyPageBody = `{"data":[],"meta":{"page":{"number":1,"size":100,"total":0}}}`