clawbot
e3f407b440
All checks were successful
check / check (push) Successful in 3m7s
No tag could be cut at all: .goreleaser.yaml had no gitea_urls block, so
goreleaser defaulted to the GitHub API, and the repo has zero tags.
.goreleaser.yaml now points at git.eeqj.de. Version derives from git via
a new script/version - exact tag with any leading v stripped, else
dev-<12-char sha>, with a -dirty suffix when tracked files are modified -
replacing the hardcoded 1.0.0-rc.1 that every local build was stamping
regardless of git state. A tag-triggered .gitea/workflows/release.yml
runs goreleaser with a scoped token (RELEASE_TOKEN); script/bootstrap
installs a sha256-verified goreleaser, and make release / release-snapshot
become script shims like every other target.
Two fabrications were removed rather than merely replaced. goreleaser's
snapshot.version_template was `{{ incpatch .Version }}-next`, which
invents a release number from the last tag - and with no tags, from
goreleaser's own fabricated v0.0.0. And internal/cli/version.go gated its
development-build notice on Version == "dev" exactly, so the moment
untagged builds carried a sha that notice would have gone silent and an
unreleased binary would have read as a release. Replaced with a tested
IsDevVersion predicate, and closed at both layers: the Makefile now
refuses to build when script/version yields nothing, and an empty version
counts as a development build - reachable today via
`docker build --build-arg VERSION=`.
The release workflow installs Go from a sha-pinned actions/setup-go
(v5.6.0) using go-version-file, so the compiler that produces released
binaries is pinned like every other external reference. Without it the
first tag push would either fail at goreleaser's before-hook or compile
the published artifacts with whatever unpinned Go the runner happened to
carry - the one unpinned thing in a release path that already refuses an
unpinned goreleaser.
Known gap: the Go tarball setup-go fetches is version-pinned but not
checksum-verified against a value in this repo, unlike the goreleaser
install and the Dockerfile digest.
61 lines
2.9 KiB
YAML
61 lines
2.9 KiB
YAML
name: release
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# actions/checkout v4, 2024-09-16
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
# goreleaser needs the tags and the full history: the version
|
|
# it stamps comes from the tag, and the changelog comes from
|
|
# the commits since the previous one. A shallow checkout
|
|
# silently produces a mislabelled release.
|
|
fetch-depth: 0
|
|
# goreleaser is not a compiler: it shells out to `go` for the
|
|
# `before:` hook and for every one of the four cross-compiles.
|
|
# Nothing else in this repo puts a Go toolchain on the runner --
|
|
# check.yml runs script/cibuild, which does all of its work inside
|
|
# the digest-pinned Dockerfile images -- so without this step the
|
|
# release either fails at the before-hook or, worse, ships binaries
|
|
# built by whatever unpinned Go the runner happens to carry.
|
|
# REPO_POLICIES.md requires every external reference to be pinned,
|
|
# and script/release already refuses a goreleaser that is not the
|
|
# pinned build; the compiler that actually produces the artifacts
|
|
# is the last thing that should be exempt from that.
|
|
#
|
|
# go-version-file rather than a literal: go.mod's `go 1.26.1` is
|
|
# the single source of truth for the toolchain, the same way the
|
|
# Dockerfile FROM line is the single source of truth for the
|
|
# linter version that script/lint enforces. It is a three-component
|
|
# version, so setup-go resolves it exactly -- no silent drift onto
|
|
# a newer patch release.
|
|
#
|
|
# actions/setup-go v5.6.0, 2025-12-15. Pinned by commit sha, like
|
|
# the checkout above. v5.x is a node20 action, matching the node20
|
|
# actions/checkout v4 already in use here; the v6/v7 line requires
|
|
# a node24 runner, which this Gitea runner has never been asked
|
|
# for and cannot be assumed to provide.
|
|
- name: Install Go
|
|
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
|
|
with:
|
|
go-version-file: go.mod
|
|
# setup-go's module cache needs a runner-side cache backend.
|
|
# A release is cut rarely and a cold module download costs
|
|
# seconds; a release failing because a cache service is absent
|
|
# costs a re-tag. Off, deliberately.
|
|
cache: false
|
|
- name: Install goreleaser
|
|
run: script/install-goreleaser
|
|
- name: Release
|
|
run: script/release
|
|
env:
|
|
# RELEASE_TOKEN is a repository Actions secret: a Gitea access
|
|
# token with write access to this repository's releases (scope
|
|
# write:repository), owned by an account that can publish here.
|
|
# It is deliberately not the runner's automatic token, which is
|
|
# not guaranteed to carry that scope.
|
|
GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|