Repository navigation
Tags: open-cli-collective/.github
Tags
fix(release): resolve Windows assets by canonical binary name (#49) ## Summary - fix shared release asset resolution for GoReleaser Windows archives whose metadata lists `cfl.exe` while identity uses `cfl` - move the resolver into a tested composite action used by `release.yml` - fail loudly when an architecture asset is missing instead of allowing jq errors inside `echo` command substitutions to be ignored - add a fixture matching the cfl 1.3.97 artifact metadata and a missing-amd64 failure check ## Evidence - Reproduced against `/tmp/cfl-1397-dist/artifacts.json`: resolves `cfl_1.3.97_windows_amd64.zip` and `cfl_1.3.97_windows_arm64.zip` - `bash actions/release-assets/test_resolve.sh` - `bash -n actions/release-assets/resolve.sh actions/release-assets/test_resolve.sh` - `actionlint` and YAML parsing passed locally - `git diff --check` passed No release was triggered and the `@v1` pointer was not changed.
feat(release): release several binaries from one manifest (#41) Closes #40 First consumer: `open-cli-collective/google-cli`, which ships `gro` and `grw` from one module, one goreleaser config, and one bare-`v` tag stream. - `packaging/identity.yml` declares exactly one of `binary:` (unchanged) or `binaries:` (list of `{name, archives, packages, keychain_probe}`); `repo`, `goreleaser_config`, `version_file`, `tag` stay top-level. - identity-check normalizes both shapes to a `binaries` list (the only consumers of the JSON are the workflows in this repo, updated here) and validates archives/nfpms/casks per owning binary through their `ids`/`builds` filters. Multi-binary Chocolatey packages live under `packaging/chocolatey/<id>/`; the flat single-binary layout is unchanged. - release.yml turns homebrew (max-parallel 1, one tap writer), chocolatey, winget, and linux-packages into matrix jobs over the binaries declaring each channel, resolves each binary's Windows archive names from `dist/artifacts.json`, and runs darwin-gate and code-signing per binary (identifier derived from the binary name). - New fixture `tests/fixtures/identity/google-cli`; existing fixtures unchanged and still validate. Verified locally: pytest (identity-check + chocolatey-push), darwin-gate and codesign gate shell suites, all six fixtures through `identity.py validate`, actionlint. Real signing and channel publishing remain runner-level coverage.
fix: make auto-release path gate CWD-independent (#26) _split_csv split the release/tool path CSVs with an unquoted `for x in $1`, so each field underwent pathname expansion. Run from a repo root — as the reusable auto-release workflow does — a tool-path glob like `tools/cfl/**` expanded into the real directory entries under tools/cfl/ instead of staying a literal pattern, so no changed file matched the tool path and EVERY change to a monorepo tool was skipped (not just version bumps; .go and go.mod too). Single-tool repos were unaffected — their tool glob has nothing to expand against. Disable globbing while splitting and restore the caller's prior setting. Add regression tests that run match-paths from a tree where tools/cfl/ exists; they fail against the old code and pass now. bash 3.2-safe. Closes #25
feat: stable macOS code-signing in the reusable release workflow + da… …rwin-gate (#24) macos-codesign-setup composite (cert import + signing script + env export, all-or-none self-gate over four secrets), darwin-gate assert-dr/check-signature with unit tests, and release.yml wiring. Atomic per caller. Closes #23