Skip to content

ci: release setup with static binaries and checksums - #4

Merged
groupsky merged 2 commits into
mainfrom
hq-job/pullgate-1-build/release
Nov 11, 2026
Merged

groupsky merged 2 commits into
mainfrom
hq-job/pullgate-1-build/release

Conversation

@groupsky

@groupsky groupsky commented Nov 11, 2026 •

Copy link
Copy Markdown
Contributor

The release setup of pullgate (#1), copied from nodkey: release-please, a read-only build job (static linux amd64/arm64, CGO_ENABLED=0, -trimpath, SHA256SUMS), and a publish job with a build provenance attestation. Plus the weekly govulncheck of the published binaries.

This makes no release. The release-please job skips itself until the release GitHub App is set up for this repo (docs/releasing.md, "One-time setup"). A release is the merge of the release pull request, and only the owner merges it.

Progress

  • .github/workflows/release.yml, release-please-config.json, .release-please-manifest.json
  • docs/releasing.md
  • weekly vuln (latest release) job
  • security review and correctness review: only low findings, fixed (release environment reviewer, T16 in the threat model, two doc lines)

🤖 Generated with Claude Code

groupsky and others added 2 commits November 11, 2026 19:10
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@groupsky
groupsky marked this pull request as ready for review November 11, 2026 17:13
@groupsky
groupsky merged commit e0848f0 into main Nov 11, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant