Repository navigation
feat: release pipeline with goreleaser, release-please, cosign and SBOMs - #4
Open
RogerCecilpot wants to merge 1 commit into
Open
RogerCecilpot wants to merge 1 commit into
RogerCecilpot wants to merge 1 commit into
Conversation
This was referenced Oct 25, 2026
RogerCecilpot
force-pushed
the
feat/253-release-pipeline
branch
from
October 25, 2026 12:56
9bb3978 to
14c1dc3
Compare
RogerCecilpot
changed the base branch from
feat/235-scaffold
to
feat/257-completion-windows-ci
October 25, 2026 12:57
release-please keeps a release PR with the next version and changelog; merging it tags vX.Y.Z. The tag triggers goreleaser on a GitHub-hosted runner: linux/darwin/windows x amd64/arm64 builds with -trimpath and the version stamped in, an SPDX SBOM per archive, a checksum file signed with cosign keyless (GitHub OIDC), and build-provenance attestations. PRs run a snapshot build of every target so config changes are caught before a tag. docs/releasing.md covers the flow, verifying downloads and the 0.x to 1.0 rules. Refs devlyft/devlyft#253 Co-Authored-By: Claude Opus 5.5 <[email protected]>
RogerCecilpot
force-pushed
the
feat/257-completion-windows-ci
branch
from
October 25, 2026 13:00
86e0e9d to
d5618b3
Compare
RogerCecilpot
force-pushed
the
feat/253-release-pipeline
branch
from
October 25, 2026 13:00
14c1dc3 to
b275ac5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes devlyft/devlyft#253.
Stacked on #2 (scaffold); retarget to
mainonce that merges.What
release-please-config.json,.release-please-manifest.json,release-please.yml): Go release type, starting from 0.0.0,bump-minor-pre-major. On push tomainit maintains a release PR; merging it creates the release andvX.Y.Ztag..goreleaser.yaml,release.ymlonv*tags): linux/darwin/windows × amd64/arm64,CGO_ENABLED=0,-trimpath, version/commit/date stamped via ldflags, commit-timemod_timestampfor reproducibility, tar.gz (zip on Windows), an SBOM per archive (syft), a sha256 checksum file signed with cosign keyless (.sig,.pem,.sigstore.json), and thenattest-build-provenancefor the archives and checksums. The changelog is left to release-please (mode: keep-existing).checks / release-snapshotjob builds every target on each PR (signing and SBOMs skipped, read-only token).make snapshotfor the same build locally.docs/releasing.md: release flow,cosign verify-blobandgh attestation verifyinstructions, the 0.x → 1.0 rules (1.0 gated on #263 browser login, #264 device login and the published stability policy; not on server-side pagination or rollout status), and known gaps (no notarization or code signing).Homebrew, Scoop, deb and rpm are left to devlyft/devlyft#258 and #260.
Security
GitHub-hosted runners only, all actions pinned to commit SHAs, top-level
contents: read. Only the tag-triggered release job getscontents: write,id-token: writeandattestations: write. No stored signing keys.Verified locally
goreleaser checkpasses.goreleaser release --snapshot --clean --skip=sign,sbombuilds all 6 archives plus checksums, and the binary reports the stamped version.make lintandmake testpass.Not yet verified
The "tagged release works" acceptance (cosign signing, SBOMs, attestations and the release-please PR) can only be exercised after this merges to
mainand the first release PR is merged.Note: goreleaser v2.19 itself needs Go ≥ 1.27.3 to
go run, somake snapshotrelies onGOTOOLCHAIN=autoto fetch it. CI uses the prebuilt goreleaser binary and builds with Go 1.26 fromgo.mod.🤖 Generated with Claude Code