Release/repo guardrails.
a. Casks/syllable.rb is unprotected from hand-edits
Auto-generated by GoReleaser, but there's no CODEOWNERS (root or .github/) and no CI check — only a header comment and a CONTRIBUTING note.
Fix: add .github/CODEOWNERS (/Casks/ @joshyork) and/or a small PR check that fails when Casks/** changes unless the head branch matches the goreleaser branch pattern.
b. goreleaser pre-release hook mutates the module graph
.goreleaser.yaml:7 runs go mod tidy in the before hook, which can rewrite go.mod/go.sum on the release runner — the shipped binary may build against an uncommitted, never-CI-tested dependency state. Line 8's go test ./... also includes integration/ (benign only because the runner lacks creds — see the integration build-tag issue).
Fix: replace go mod tidy with go mod verify (or go mod tidy -diff, which fails instead of mutating); rely on the build-tag fix for the test hook.
Effort: S.
Release/repo guardrails.
a.
Casks/syllable.rbis unprotected from hand-editsAuto-generated by GoReleaser, but there's no
CODEOWNERS(root or.github/) and no CI check — only a header comment and a CONTRIBUTING note.Fix: add
.github/CODEOWNERS(/Casks/ @joshyork) and/or a small PR check that fails whenCasks/**changes unless the head branch matches the goreleaser branch pattern.b. goreleaser pre-release hook mutates the module graph
.goreleaser.yaml:7runsgo mod tidyin thebeforehook, which can rewritego.mod/go.sumon the release runner — the shipped binary may build against an uncommitted, never-CI-tested dependency state. Line 8'sgo test ./...also includesintegration/(benign only because the runner lacks creds — see the integration build-tag issue).Fix: replace
go mod tidywithgo mod verify(orgo mod tidy -diff, which fails instead of mutating); rely on the build-tag fix for the test hook.Effort: S.