Automate releases and publish Homebrew cask to own tap - #1
Merged
Conversation
Releases were cut from a laptop and the formula copied into the tap by hand. Tagging now drives everything from CI. Also migrates the deprecated brews config to homebrew_casks: formulas are meant to build from source, casks ship pre-compiled binaries, and casks gained Linux support in Homebrew/brew#19121.
Supply-chain hardening based on GoReleaser's example-secure reference and a zizmor audit (now clean): - Pin all actions to commit SHAs; Dependabot with a 7-day cooldown keeps them fresh without picking up freshly-compromised releases. - Attest SLSA build provenance for all release artifacts; users verify with 'gh attestation verify'. Ship SPDX SBOMs per archive. - Scope workflow permissions per job, drop checkout credential persistence, disable Go build cache in the release job. - Build reproducibly: -trimpath, commit-pinned mod timestamps, exact Go toolchain from go.mod, no release-time go mod tidy. - Pin the golangci-lint install script to its release tag instead of master. CI lint was crashing because go-version '^1.25.6' resolved to Go 1.26.4, which golangci-lint 2.6.2 cannot typecheck; go-version-file follows the toolchain in go.mod instead. Verified locally: 0 issues under 1.25.6, reproduces the crash under 1.26.4.
GoReleaser OSS has no nightly mode, so the snapshot workflow publishes a prerelease itself and renders the jira-cli-snapshot cask from the build's checksums — snapshots get the same pinned SHA-256s, provenance attestation, and SBOMs as releases. Old snapshots are pruned, keeping 5. Also moves the Docker workflow to trigger on the tag push: releases are now created by a workflow with GITHUB_TOKEN, whose events GitHub suppresses, so the release:published trigger would never fire again.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.