feat(release): publish verifiable release artifacts from a version tag - #58
Merged
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughSummary
Validation
WalkthroughThe release workflow publishes eight platform archives from version tags. GoReleaser creates platform-specific archives, checksums, and version metadata. Post-release checks validate archive coverage, checksum integrity, shell version, and protocol version. Pull-request builds cover the release target matrix. Make targets and documentation describe local snapshots and artifact contracts. Device authorization intervals now use Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant AcceptanceGate
participant GoReleaser
participant GitHubRelease
participant ReleaseVerifier
GitHubActions->>AcceptanceGate: Run acceptance checks
AcceptanceGate-->>GitHubActions: Return result
GitHubActions->>GoReleaser: Build and publish release
GoReleaser->>GitHubRelease: Upload archives and checksums
GitHubActions->>ReleaseVerifier: Download published assets
ReleaseVerifier->>GitHubRelease: Read archives and checksum asset
ReleaseVerifier-->>GitHubActions: Return checksum and version results
Suggested reviewers: Merge Risk: ⚪ Minimal · up to The PR adds tag-based release packaging and verification with documented local snapshot validation; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 117-122: Update the archive verification block in the release
workflow to compare the sorted basenames of all generated .tar.gz and .zip
archives against the sorted filenames recorded in checksums.txt, rather than
comparing only counts. Fail with an error when the name sets differ, including
missing or duplicate coverage, while preserving the existing successful path and
failure exit behavior.
In `@docs/reference/release-artifacts.md`:
- Around line 40-43: Update the archive-name construction guidance in the
release-artifacts documentation to require normalizing the operating-system
value from uname -s to the lowercase archive tokens, such as linux and darwin,
before building the URL or filename. Keep the existing tag and architecture
handling unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 74b04281-099e-4b00-b039-005fc551182e
📒 Files selected for processing (8)
.github/workflows/pr-checks.yml.github/workflows/release.yml.goreleaser.yamlMakefiledocs/README.mddocs/reference/release-artifacts.mdinternal/auth/fakeissuer/fakeissuer.gotest/acceptance/login_device_test.go
This was referenced Aug 10, 2026
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/reference/release-artifacts.md`:
- Around line 43-48: Update the platform normalization paragraph to document the
Windows detection path and map supported Windows environments to the `windows`
token. State that unsupported or unrecognized Windows platform values follow the
same refusal rule rather than being guessed, and identify the separate detection
mechanism if Windows does not use `uname`.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 241f0f7d-2d13-4133-8eb6-12aebd243d27
📒 Files selected for processing (2)
.github/workflows/release.ymldocs/reference/release-artifacts.md
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/release.yml
sachiniSam
approved these changes
Aug 14, 2026
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #53. First of five stacked changes for #52.
Adds
.goreleaser.yaml, a tag-triggered release workflow that runs the acceptance gate before publishing and verifies the published assets afterwards, anddocs/reference/release-artifacts.mdas the naming and checksum contract that #54 and #55 read. Extends the pull-request cross-build check from three targets to all eight the release ships.Verified locally with
make release-snapshot: eight archives with the documented names, all checksums verify, and the extracted binary reports the injected version rather than0.0.0-dev. No tag has been pushed, so the publish path itself is unexercised.Two incidental findings: adding the 32-bit targets exposed a test constant that could not compile on
linux/386orlinux/arm(the fake issuer'sDeviceIntervalis nowint64, matching what the production code already takes), and GoReleaser builds ARMv6 where Go defaults to ARMv7, so the check now pinsGOARM=6to compile what actually ships.