Make the tagged-release path work on Gitea (closes #65)
All checks were successful
check / check (pull_request) Successful in 2m37s
All checks were successful
check / check (pull_request) Successful in 2m37s
No tag could be cut from this repo at all. Three independent blockers. goreleaser was configured for GitHub while the repo lives on Gitea: .goreleaser.yaml had a release: block but no gitea_urls:, so goreleaser defaulted to the GitHub API and a release would have failed or published somewhere nobody is looking. It now points at https://git.eeqj.de/api/v1. The version was a hardcoded Makefile constant, VERSION := 1.0.0-rc.1, so every local build claimed to be a release candidate that had never been tagged and did not exist, while git tag -l was empty and internal/globals defaulted to dev. The version now comes from git, via the new script/version: the exact tag with a leading v stripped when HEAD is on one (so a make build and a goreleaser build of the same commit report the same string, and it matches the archive names), otherwise dev-<12-char sha>, with -dirty appended in either case when tracked files are modified. Untracked files are not counted, matching git describe --dirty. goreleaser's snapshot template gets the same treatment: it was {{ incpatch .Version }}-next, which manufactures a release number from the last tag and, with no tags at all, from goreleaser's fabricated v0.0.0. That change had one non-obvious consequence. internal/cli/version.go gated its "this is a development build" notice on the version being exactly "dev", so as soon as untagged builds carried a commit sha the notice would have gone silent and an unreleased binary would have read as a release. The gate is now globals.IsDevVersion, a predicate over a string rather than a comparison against a global so that it can be tested, and it is tested at the boundary that matters: dev-<sha> and its -dirty variant are development builds, 1.0.0-dev and 1.0.0-rc.1 are not. The command writes to cmd.OutOrStdout() so its output can be asserted on at all. Releases now come from CI rather than a workstation: a tag-triggered .gitea/workflows/release.yml, with fetch-depth: 0 because a shallow checkout has no tags and would silently mislabel the release, and with the RELEASE_TOKEN repository secret passed as GITEA_TOKEN (documented in README.md; the runner's automatic token is deliberately not used, since it is not guaranteed to carry release write scope). script/release unsets any GITHUB_TOKEN or GITLAB_TOKEN it finds, because goreleaser picks its forge from whichever token variable is set and refuses to run when it sees more than one -- an unrelated runner token must not get to decide where these artifacts are published. make release and make release-snapshot were the last two Makefile targets that were not shims; they now call script/release and script/release-snapshot, which resolve goreleaser the way script/lint resolves the linter -- a PATH binary is accepted only at the pinned version, never as a silent fallback. script/bootstrap installs it from a sha256-verified GitHub release archive per REPO_POLICIES.md, through a separate script/install-goreleaser: separate because script/bootstrap hard-fails without a usable Docker daemon by design, and the release runner needs goreleaser without needing Docker. dist/ and .tool/ are gitignored and excluded from the Docker build context. Verified by running it: make release-snapshot produces the four linux,darwin x amd64,arm64 archives plus checksums.txt, and the binary from dist/ reports dev-<sha> with the development-build notice. Tag handling was exercised in a throwaway repository; no tag was created here, since that is the owner's call. Signing, SBOM, reproducible builds, shell completions and a man page remain out of scope.
This commit is contained in:
65
TODO.md
65
TODO.md
@@ -14,10 +14,73 @@ pre-1.0
|
||||
|
||||
# Next Step
|
||||
|
||||
Define remaining scope for a first tagged release and cut v0.1.0.
|
||||
Define the remaining scope for the first tagged release under the 1.0.0
|
||||
milestone, then cut that tag. The mechanism to cut it now exists and is
|
||||
exercised; what is left is the scope decision, which is the owner's.
|
||||
This step deliberately names one version number: it previously said
|
||||
"cut v0.1.0" while the `Makefile` baked in `1.0.0-rc.1` and the issue
|
||||
milestone said 1.0.0, and three different answers to "what is the next
|
||||
release" is exactly the contradiction
|
||||
[issue #65](https://git.eeqj.de/sneak/vaultik/issues/65) was filed over.
|
||||
|
||||
# Completed Steps
|
||||
|
||||
- 2026-08-09: Made the tagged-release path actually work on Gitea
|
||||
([issue #65](https://git.eeqj.de/sneak/vaultik/issues/65)). Three
|
||||
independent blockers, one of which was the whole
|
||||
release: `.goreleaser.yaml` had no `gitea_urls:` block, so goreleaser
|
||||
defaulted to the GitHub API and a `goreleaser release` from this repo
|
||||
would have failed or published where nobody is looking. It now points
|
||||
at `https://git.eeqj.de/api/v1`. The version is the second: it was a
|
||||
hardcoded `VERSION := 1.0.0-rc.1` in the `Makefile`, so every local
|
||||
build claimed to be a release candidate that had never been tagged and
|
||||
did not exist, while `git tag -l` was empty and `internal/globals`
|
||||
defaulted to `dev`. Version now comes from git via the new
|
||||
`script/version` — the exact tag with a leading `v` stripped (so a
|
||||
`make` build and a goreleaser build of one commit report the same
|
||||
string, and it matches the archive names), otherwise `dev-<12-char
|
||||
sha>`, with `-dirty` appended in either case when tracked files are
|
||||
modified. Untracked files are deliberately not counted, matching
|
||||
`git describe --dirty`. The same honesty was owed by the snapshot
|
||||
path: `snapshot.version_template` was `{{ incpatch .Version }}-next`,
|
||||
which manufactures a release number from the last tag and, with no
|
||||
tags at all, from goreleaser's fabricated `v0.0.0`; it now emits the
|
||||
same `dev-<sha>`. The one non-obvious consequence is that
|
||||
`internal/cli/version.go` gated its "this is a development build"
|
||||
notice on the version being exactly `dev`, so the moment untagged
|
||||
builds began carrying a commit sha that notice would have gone silent
|
||||
and an unreleased binary would have read as a release — the gate is
|
||||
now `globals.IsDevVersion`, which is a predicate over a string rather
|
||||
than a comparison against a global precisely so it can be tested, and
|
||||
it is tested at the boundary (`1.0.0-dev` is a release, `dev-<sha>`
|
||||
is not). Release automation is the third blocker: a tag-triggered
|
||||
`.gitea/workflows/release.yml` runs the build in CI rather than from
|
||||
a laptop, with `fetch-depth: 0` because a shallow checkout has no
|
||||
tags and would silently mislabel the release, and with the
|
||||
`RELEASE_TOKEN` repository secret passed as `GITEA_TOKEN` (documented
|
||||
in `README.md`; the runner's automatic token is not used because it
|
||||
is not guaranteed to carry release write scope). `script/release`
|
||||
unsets any `GITHUB_TOKEN`/`GITLAB_TOKEN` it finds, since goreleaser
|
||||
chooses its forge from whichever token variable is set and refuses to
|
||||
run when it sees more than one — a runner-provided token must not get
|
||||
to decide where these artifacts are published. `make release` and
|
||||
`make release-snapshot`, the last two Makefile targets that were not
|
||||
shims, now call `script/release` and `script/release-snapshot`, which
|
||||
resolve goreleaser exactly the way `script/lint` resolves the linter:
|
||||
a `PATH` binary is used only at the pinned version, never as a silent
|
||||
fallback. `script/bootstrap` installs it, from a sha256-verified
|
||||
GitHub release archive per `REPO_POLICIES.md`, via a separate
|
||||
`script/install-goreleaser` — separate because `script/bootstrap`
|
||||
hard-fails without a usable Docker daemon by design, and the release
|
||||
runner needs goreleaser without needing Docker. Verified by running
|
||||
the thing rather than reading it: `make release-snapshot` produced
|
||||
four archives and `checksums.txt`, and the linux/amd64 binary from
|
||||
`dist/` reports `dev-<sha>` with the development-build notice. Tag
|
||||
handling was exercised in a throwaway repository rather than by
|
||||
tagging this one; no tag was created here, since that is the owner's
|
||||
call. Signing, SBOM, reproducible builds, completions and a man page
|
||||
are out of scope by the issue.
|
||||
|
||||
- 2026-08-09: Isolated the lint cache per worktree and context-gated the
|
||||
native lint path (issues #99, #80). One defect seen twice:
|
||||
`script/lint` decided whether it could skip the pinned image by asking
|
||||
|
||||
Reference in New Issue
Block a user