refactor(v1.5.0): releases move to CI: pushing a tag now builds and publishes, and push.sh only ships commits and tag unless --full is given — Actions is free on public repositories, so the published binaries stop depending on whichever toolchain this workstation happens to have

Author: rosaldo

.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+# The same three checks the commit gate runs locally (scripts/commit.sh), so a green commit
+# cannot turn red on push for a reason the author could have seen beforehand.
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      # Reported as a failure with the file list, rather than rewriting the tree: CI that edits
+      # the code hides the problem instead of showing it.
+      - name: gofmt
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "Files not gofmt'd:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: go vet
+        run: go vet ./...
+
+      - name: go build
+        run: go build ./...
+
+      - name: go test
+        run: go test ./... -count=1

.github/workflows/release.yml

@@ -0,0 +1,74 @@
+# Builds the binaries and publishes them as Release assets when a vX.Y.Z tag is pushed.
+#
+# This is the NORMAL path: `scripts/push.sh` pushes the commits and the tag, and the tag is what
+# starts this. Building here rather than on a workstation means the published artefact depends
+# only on the tag and on this file — not on which Go version someone happened to have installed.
+#
+# It is free: Actions on standard runners costs nothing for public repositories, so there is no
+# quota argument for building elsewhere.
+#
+# `scripts/push.sh --full` does the same job locally and uploads the result, for when this
+# workflow cannot run.
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch: {}
+
+permissions:
+  contents: write # create the Release and attach the assets
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # the tag's annotation becomes the release notes
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      # The suite runs before anything is published. A tag that does not pass must not become a
+      # release somebody downloads.
+      - name: Test
+        run: go test ./... -count=1
+
+      - name: Build
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME}"
+          mkdir -p dist
+          # CGO off gives a static binary that runs on any distribution — no glibc version to
+          # match. -trimpath keeps local paths out of it, and -s -w drops the debug tables.
+          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64; do
+            os="${target%/*}"; arch="${target#*/}"
+            out="dist/api-mcp_${tag}_${os}_${arch}"
+            [ "$os" = "windows" ] && out="${out}.exe"
+            CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" go build -trimpath \
+              -ldflags "-s -w -X main.version=${tag#v}" -o "$out" .
+          done
+          # Checksums travel with the binaries so anyone can verify what they downloaded. One
+          # file, in the format `sha256sum -c` reads directly.
+          ( cd dist && sha256sum api-mcp_* > SHA256SUMS )
+          ls -l dist
+
+      - name: Publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME}"
+          notes="$(git tag -l "$tag" --format='%(contents)')"
+          # `--latest` is explicit on both paths. Left to GitHub it is decided by DATE, which is
+          # wrong whenever two releases go out close together — the label can land on the LOWER
+          # version.
+          if gh release view "$tag" >/dev/null 2>&1; then
+            # `--clobber`: without it the Release keeps the previous run's binaries, silently.
+            gh release upload "$tag" dist/* --clobber
+            gh release edit "$tag" --notes "$notes" --latest
+          else
+            gh release create "$tag" dist/* --title "$tag" --notes "$notes" --latest
+          fi

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 > Generated from `git` by `scripts/gen-changelog.sh` — do not edit by hand.
 
+- **v1.5.0** (2026-08-23) · `refactor` — releases move to CI: pushing a tag now builds and publishes, and push.sh only ships commits and tag unless --full is given — Actions is free on public repositories, so the published binaries stop depending on whichever toolchain this workstation happens to have
 - **v1.4.0** (2026-08-22) · `feat` — sign gains method, base64 and iso8601 timestamps: a scheme that signs the verb, encodes base64 and stamps an ISO instant had no way to be expressed — and every one of those mismatches fails as an authentication error that never names the format
 - **v1.3.1** (2026-08-19) · `fix` — property names the MCP client refuses are aliased: it validates arguments against ^[a-zA-Z0-9_.-]{1,64}$ and rejects the whole CALL when one fails — PHP-style filters[offer_id] broke 7 of 9 tools on a real API
 - **v1.3.0** (2026-08-19) · `feat` — per-request signature auth: APIs that sign every call over its own content — sha256 or hmac-sha256, with the payload and destination as templates

README.md

@@ -177,10 +177,12 @@ A large spec becomes dozens of tools, and each one takes up the model's context:
 
 ```sh
 ./commit.sh feat "what changed"   # gate → version bump → CHANGELOG → tag
-./push.sh                         # build the binaries, push, tag and publish the Release
+./push.sh                         # push the commits and the tag; CI builds and publishes
+./push.sh --full                  # ...or build the binaries here and upload them
 ```
 
-Both are shortcuts to `scripts/`.
+Both are shortcuts to `scripts/`. Pushing a `vX.Y.Z` tag starts the release workflow, which
+cross-compiles and publishes; `--full` does the same locally, for when the workflow cannot run.
 
 ## Documentation
 

VERSION

@@ -1 +1 @@
-1.4.0
+1.5.0

scripts/push.sh

@@ -1,25 +1,38 @@
 #!/usr/bin/env bash
-# push.sh — ships the work: commits, this version's tag and the GitHub Release.
+# push.sh — ships the work: the commits and this version's tag.
 #
-# Usage:  ./push.sh          (root shortcut → this file, same as ./commit.sh)
+# Usage:
+#   ./push.sh              push the commits and the tag; CI builds and publishes the Release
+#   ./push.sh --full       ALSO build the binaries here and upload them (-f works too)
 #
-# What CLOSES a version is ./commit.sh (bump, changelog, tag). This script only publishes it.
-# The expensive checks run BEFORE anything is pushed, so the script fails without leaving half
-# the work out there.
+# What CLOSES a version is ./commit.sh (bump, changelog, tag). This script only ships it.
 #
-# Order: build the binaries → git push → git push of this version's tag → publish/update the
-# Release with the binaries attached. Building comes first on purpose: a compile error must not
-# be discovered after the commits are already public.
+# By default nothing is built here. Pushing the tag starts .github/workflows/release.yml, which
+# cross-compiles and publishes — and on a public repository that costs nothing, so there is no
+# reason to spend a workstation's time on it or to make the artefact depend on whichever Go
+# version that machine has.
 #
-# Requires: `gh` authenticated with write access to the repo
+# `--full` is the escape hatch: it builds locally and uploads, for when the workflow cannot run
+# (GitHub Actions down, or a release that has to go out from here). The tag still triggers the
+# workflow, which will overwrite the assets with its own build — same inputs, same output.
+#
+# Requires: `gh` authenticated with write access to the repo (only with --full)
 #   gh auth login
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/.." && pwd)"
 
-log()  { printf '\n\033[1m==> %s\033[0m\n' "$*"; }
-ok()   { printf '    \033[0;32m✓\033[0m %s\n' "$*"; }
-die()  { printf '\n\033[0;31m!! %s\033[0m\n' "$*" >&2; exit 1; }
+log() { printf '\n\033[1m==> %s\033[0m\n' "$*"; }
+ok()  { printf '    \033[0;32m✓\033[0m %s\n' "$*"; }
+die() { printf '\n\033[0;31m!! %s\033[0m\n' "$*" >&2; exit 1; }
+
+FULL=0
+for arg in "$@"; do
+  case "$arg" in
+    -f|--full) FULL=1 ;;
+    *) die "unknown argument: $arg (usage: $0 [--full])" ;;
+  esac
+done
 
 TAG_VERSION="$(cat "$ROOT/VERSION" 2>/dev/null)" && [[ -n "$TAG_VERSION" ]] \
   || die "VERSION missing in $ROOT"
@@ -34,76 +47,79 @@ TAG="v${TAG_VERSION}"
 git -C "$ROOT" rev-parse "$TAG" >/dev/null 2>&1 \
   || die "tag ${TAG} does not exist — ./commit.sh creates it alongside the release commit"
 
-command -v gh >/dev/null 2>&1 || die "gh (GitHub CLI) is not installed — https://cli.github.com"
-command -v go >/dev/null 2>&1 || die "go is not installed — the binaries are built here"
+if [[ $FULL -eq 1 ]]; then
+  command -v gh >/dev/null 2>&1 || die "gh (GitHub CLI) is not installed — https://cli.github.com"
+  command -v go >/dev/null 2>&1 || die "go is not installed — --full builds the binaries here"
 
-# A REAL credential check: it asks for WRITE permission, not just whether the repo can be read.
-#
-# Reading is not the question — the repository is public, so any account can do it, including
-# one that cannot publish a thing. Checking only for read is how the commits and the tag went
-# up and the Release did not: `gh` was authenticated as another account, and the failure only
-# surfaced at the last step, with everything already public.
-#
-# The error `gh` reports in that case blames the "workflow" scope, which sends you off
-# refreshing a token that was never the problem. Hence the explicit message here.
-log "checking GitHub credentials"
-GH_USER="$(gh api user --jq .login 2>/dev/null)" \
-  || die "not authenticated with gh.
+  # A REAL credential check: it asks for WRITE permission, not just whether the repo can be read.
+  #
+  # Reading is not the question — the repository is public, so any account can do it, including
+  # one that cannot publish a thing. Checking only for read is how commits and tag go up and the
+  # Release does not: `gh` authenticated as another account, and the failure surfacing at the
+  # last step with everything already public.
+  #
+  # The error `gh` reports in that case blames the "workflow" scope, which sends you off
+  # refreshing a token that was never the problem. Hence the explicit message here.
+  log "checking GitHub credentials"
+  GH_USER="$(gh api user --jq .login 2>/dev/null)" \
+    || die "not authenticated with gh.
     Authenticate with:
         gh auth login"
-# owner/repo out of the remote URL, whatever its shape: https://github.com/owner/repo.git,
-# git@github.com:owner/repo.git, or an SSH host alias (git@github-work:owner/repo).
-REMOTE_URL="$(git -C "$ROOT" remote get-url origin)"
-REPO="$(printf '%s\n' "${REMOTE_URL%.git}" | awk -F'[:/]' '{print $(NF-1)"/"$NF}')"
-gh api "repos/${REPO}" --jq '.permissions.push' 2>/dev/null | grep -q true \
-  || die "the account '${GH_USER}' has no write access to ${REPO}.
+  # owner/repo out of the remote URL, whatever its shape: https://github.com/owner/repo.git,
+  # git@github.com:owner/repo.git, or an SSH host alias (git@github-work:owner/repo).
+  REMOTE_URL="$(git -C "$ROOT" remote get-url origin)"
+  REPO="$(printf '%s\n' "${REMOTE_URL%.git}" | awk -F'[:/]' '{print $(NF-1)"/"$NF}')"
+  gh api "repos/${REPO}" --jq '.permissions.push' 2>/dev/null | grep -q true \
+    || die "the account '${GH_USER}' has no write access to ${REPO}.
     You are probably authenticated as the wrong account. Check with:
         gh auth status
     and switch with:
         gh auth switch --user <account>"
-ok "credentials ok (${GH_USER} can write to ${REPO})"
+  ok "credentials ok (${GH_USER} can write to ${REPO})"
+fi
 
-# --- 1. the binaries --------------------------------------------------------
-# Cross-compiled here, not by CI: this repository has no workflow, and a release whose binaries
-# depend on a machine nobody controls is a release that stops working without warning.
-#
-# CGO_ENABLED=0 gives a static binary that runs on any distribution — no glibc version to match.
-# `-trimpath` keeps local paths out of the binary, and `-s -w` drops the debug tables (~30%).
-# The version is embedded so `api-mcp` in the wild can say which build it is.
-BUILD_DIR="$(mktemp -d)"
-# The binaries are disposable: they are the Release's artifact, not the repository's. They go
-# even if publishing fails, so they never become stray files the next `git status` reports.
-trap 'rm -rf "$BUILD_DIR"' EXIT
-
-log "building binaries for ${TAG}"
-for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64; do
-  os="${target%/*}"; arch="${target#*/}"
-  out="${BUILD_DIR}/api-mcp_${TAG}_${os}_${arch}"
-  [[ "$os" == "windows" ]] && out="${out}.exe"
-  CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" go build -trimpath \
-    -ldflags "-s -w -X main.version=${TAG_VERSION}" -o "$out" "$ROOT" \
-    || die "build failed for ${target} — nothing was pushed"
-  ok "$(basename "$out") ($(du -h "$out" | cut -f1))"
-done
+# --- 1. the binaries, only with --full --------------------------------------
+if [[ $FULL -eq 1 ]]; then
+  BUILD_DIR="$(mktemp -d)"
+  # The binaries are disposable: they are the Release's artifact, not the repository's. They go
+  # even if publishing fails, so they never become stray files the next `git status` reports.
+  trap 'rm -rf "$BUILD_DIR"' EXIT
+
+  log "building binaries for ${TAG}"
+  for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64; do
+    os="${target%/*}"; arch="${target#*/}"
+    out="${BUILD_DIR}/api-mcp_${TAG}_${os}_${arch}"
+    [[ "$os" == "windows" ]] && out="${out}.exe"
+    CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" go build -trimpath \
+      -ldflags "-s -w -X main.version=${TAG_VERSION}" -o "$out" "$ROOT" \
+      || die "build failed for ${target} — nothing was pushed"
+    ok "$(basename "$out") ($(du -h "$out" | cut -f1))"
+  done
 
-# Checksums travel with the binaries so anyone can verify what they downloaded is what was
-# published. One file, the format `sha256sum -c` reads directly.
-( cd "$BUILD_DIR" && sha256sum api-mcp_* > SHA256SUMS )
-ok "SHA256SUMS"
+  ( cd "$BUILD_DIR" && sha256sum api-mcp_* > SHA256SUMS )
+  ok "SHA256SUMS"
+fi
 
 # --- 2. git -----------------------------------------------------------------
 log "git push"
 git -C "$ROOT" push
 
 # ONLY this version's tag, never `--tags`.
 #
-# `--tags` pushes every pending tag at once, and each one triggers a CI job. With two going up
-# together the jobs run in parallel and the "Latest" label lands on whichever finishes last —
-# which may well be the LOWER version. One tag per release, in order.
+# `--tags` pushes every pending tag at once, and each one starts a workflow run. With two going
+# up together the runs happen in parallel and the "Latest" label lands on whichever finishes
+# last — which may well be the LOWER version. One tag per release, in order.
 log "git push of tag ${TAG}"
 git -C "$ROOT" push origin "$TAG"
 
 # --- 3. the Release ---------------------------------------------------------
+if [[ $FULL -eq 0 ]]; then
+  log "done"
+  ok "$(git -C "$ROOT" rev-parse --short HEAD) · ${TAG}"
+  ok "CI is building and publishing the Release — watch it with: gh run watch"
+  exit 0
+fi
+
 # Idempotent: it exists → update the notes; it does not → create it.
 #
 # `--latest` is EXPLICIT on both paths. Without it GitHub decides by DATE, and that decision is