ea3d702b1f67d5aaccd3cbff4f34ffd8decb88c7
3
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 sneak
|
ea3d702b1f |
Make the tagged-release path work on Gitea (closes #65)
check / check (pull_request) Successful in 2m24s
No tag could be cut from this repo at all. Three independent blockers. goreleaser was configured for GitHub while the repo lives on Gitea: .goreleaser.yaml had a release: block but no gitea_urls:, so goreleaser defaulted to the GitHub API and a release would have failed or published somewhere nobody is looking. It now points at https://git.eeqj.de/api/v1. The version was a hardcoded Makefile constant, VERSION := 1.0.0-rc.1, so every local build claimed to be a release candidate that had never been tagged and did not exist, while git tag -l was empty and internal/globals defaulted to dev. The version now comes from git, via the new script/version: the exact tag with a leading v stripped when HEAD is on one (so a make build and a goreleaser build of the same commit report the same string, and it matches the archive names), otherwise dev-<12-char sha>, with -dirty appended in either case when tracked files are modified. Untracked files are not counted, matching git describe --dirty. goreleaser's snapshot template gets the same treatment: it was {{ incpatch .Version }}-next, which manufactures a release number from the last tag and, with no tags at all, from goreleaser's fabricated v0.0.0. That change had one non-obvious consequence. internal/cli/version.go gated its "this is a development build" notice on the version being exactly "dev", so as soon as untagged builds carried a commit sha the notice would have gone silent and an unreleased binary would have read as a release. The gate is now globals.IsDevVersion, a predicate over a string rather than a comparison against a global so that it can be tested, and it is tested at the boundary that matters: dev-<sha> and its -dirty variant are development builds, 1.0.0-dev and 1.0.0-rc.1 are not. The command writes to cmd.OutOrStdout() so its output can be asserted on at all. Releases now come from CI rather than a workstation: a tag-triggered .gitea/workflows/release.yml, with fetch-depth: 0 because a shallow checkout has no tags and would silently mislabel the release, and with the RELEASE_TOKEN repository secret passed as GITEA_TOKEN (documented in README.md; the runner's automatic token is deliberately not used, since it is not guaranteed to carry release write scope). script/release unsets any GITHUB_TOKEN or GITLAB_TOKEN it finds, because goreleaser picks its forge from whichever token variable is set and refuses to run when it sees more than one -- an unrelated runner token must not get to decide where these artifacts are published. make release and make release-snapshot were the last two Makefile targets that were not shims; they now call script/release and script/release-snapshot, which resolve goreleaser the way script/lint resolves the linter -- a PATH binary is accepted only at the pinned version, never as a silent fallback. script/bootstrap installs it from a sha256-verified GitHub release archive per REPO_POLICIES.md, through a separate script/install-goreleaser: separate because script/bootstrap hard-fails without a usable Docker daemon by design, and the release runner needs goreleaser without needing Docker. dist/ and .tool/ are gitignored and excluded from the Docker build context. The release workflow installs its own Go toolchain, pinned. goreleaser is not a compiler: it shells out to go for the before: hook and for all four cross-compiles, and nothing else in this repo puts a toolchain on the runner, since check.yml does all of its work inside the digest-pinned Dockerfile images. Without that step a tag either fails at the before-hook or, worse, ships binaries built by whatever unpinned Go the runner happens to carry -- the one unpinned thing in a release path whose every other input is hash-pinned, in a repo whose policy admits no exceptions and whose own script/release refuses a goreleaser that is not the pinned build. actions/setup-go is pinned by commit sha like the checkout above it, and reads its version from go.mod rather than restating it. An unobtainable version can no longer produce a binary at all. $(shell) discards exit status, so a missing or broken script/version left VERSION empty and the build went ahead and stamped nothing; the Makefile now stops with an error instead. IsDevVersion("") became true as the second line of defence, for a binary linked by something other than the Makefile: nothing that knows its version reports no version, so an empty version means the stamping failed, and a build that cannot be shown to be a release is not one. This is the same defect class as the notice that went silent above, one layer down. Verified by running it: make release-snapshot produces the four linux,darwin x amd64,arm64 archives plus checksums.txt, and the binary from dist/ reports dev-<sha> with the development-build notice. Tag handling was exercised in a throwaway repository; no tag was created here, since that is the owner's call. Signing, SBOM, reproducible builds, shell completions and a man page remain out of scope. |
||
|
sneak
|
0b95cb4308 |
Fix --cron silence, add snapshot cleanup, fix .gitignore
--cron now sets Vaultik.Stdout to io.Discard so all user-facing output is suppressed, not just the scanner progress. Errors still go to stderr via the structured logger. snapshot list now warns when local snapshot records have no matching remote metadata, and suggests 'vaultik snapshot cleanup' instead of silently deleting them. snapshot cleanup is a new subcommand that explicitly removes stale local snapshot records. syncWithRemote (used by purge) still does this automatically since purge is already destructive. .gitignore changed from 'vaultik' to '/vaultik' so it only matches the binary at the repo root, not the internal/vaultik/ directory. |
||
|
sneak
|
bcbc186286 |
Refactor CLI to use flags instead of positional arguments
- Change all commands to use flags (--bucket, --prefix, etc.) - Add --config flag to backup command - Support VAULTIK_CONFIG environment variable for config path - Use /etc/vaultik/config.yml as default config location - Add test/config.yaml for testing - Update tests to use environment variable for config path - Add .gitignore for build artifacts and local configs - Update documentation to reflect new CLI syntax |