4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	d809990832	Hash-verify the Go toolchain in the release workflow (closes #105) ... The release workflow installed Go via actions/setup-go, which pins the action but not the toolchain tarball it downloads at runtime -- the compiler that produces the published binaries was the last external input in the release path verified against nothing in the repo, against REPO_POLICIES.md's hash-pin rule. New script/install-go, modelled on script/install-goreleaser, downloads the exact go.dev archive for go.mod's `go` directive and refuses it unless its sha256 matches a value committed in the script. release.yml calls it instead of setup-go and sets GOTOOLCHAIN=local so that exact compiler builds the release. The version is not duplicated: go.mod owns it and install-go fails when its committed GO_VERSION disagrees, so bumping Go edits go.mod, the checksum, and the Dockerfile golang digest together. Model: opus-4-8	2026-09-21 07:45:47 +00:00
clawbot	e3f407b440	Make the tagged-release path work on Gitea (closes #65) ... No tag could be cut at all: .goreleaser.yaml had no gitea_urls block, so goreleaser defaulted to the GitHub API, and the repo has zero tags. .goreleaser.yaml now points at git.eeqj.de. Version derives from git via a new script/version - exact tag with any leading v stripped, else dev-<12-char sha>, with a -dirty suffix when tracked files are modified - replacing the hardcoded 1.0.0-rc.1 that every local build was stamping regardless of git state. A tag-triggered .gitea/workflows/release.yml runs goreleaser with a scoped token (RELEASE_TOKEN); script/bootstrap installs a sha256-verified goreleaser, and make release / release-snapshot become script shims like every other target. Two fabrications were removed rather than merely replaced. goreleaser's snapshot.version_template was `{{ incpatch .Version }}-next`, which invents a release number from the last tag - and with no tags, from goreleaser's own fabricated v0.0.0. And internal/cli/version.go gated its development-build notice on Version == "dev" exactly, so the moment untagged builds carried a sha that notice would have gone silent and an unreleased binary would have read as a release. Replaced with a tested IsDevVersion predicate, and closed at both layers: the Makefile now refuses to build when script/version yields nothing, and an empty version counts as a development build - reachable today via `docker build --build-arg VERSION=`. The release workflow installs Go from a sha-pinned actions/setup-go (v5.6.0) using go-version-file, so the compiler that produces released binaries is pinned like every other external reference. Without it the first tag push would either fail at goreleaser's before-hook or compile the published artifacts with whatever unpinned Go the runner happened to carry - the one unpinned thing in a release path that already refuses an unpinned goreleaser. Known gap: the Go tarball setup-go fetches is version-pinned but not checksum-verified against a value in this repo, unlike the goreleaser install and the Dockerfile digest.	2026-08-09 18:03:18 +02:00
sneak	43346e62db	Adopt scripts-to-rule-them-all: script/ entrypoints, Makefile shims	2026-07-07 01:53:18 +02:00
4 people	c24e7e6360	Add make check target and CI workflow (#42) ... Adds a `make check` target that verifies formatting (gofmt), linting (golangci-lint), and tests (go test -race) without modifying files. Also adds `.gitea/workflows/check.yml` CI workflow that runs on pushes and PRs to main. `make check` passes cleanly on current main. Co-authored-by: user <user@Mac.lan guest wan> Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Co-authored-by: clawbot <clawbot@sneak.berlin> Reviewed-on: #42 Co-authored-by: clawbot <sneak+clawbot@sneak.cloud> Co-committed-by: clawbot <sneak+clawbot@sneak.cloud>	2026-03-17 12:39:44 +01:00