From 0f6e12d24355bdc0b91883ea6dd2426486168039 Mon Sep 17 00:00:00 2001 From: Jake Thomas Date: Mon, 10 Aug 2026 14:20:32 -0400 Subject: [PATCH 1/5] ci: adopt shared release policy --- .github/workflows/release.yaml | 83 +++++++--------------------------- README.md | 4 +- 2 files changed, 19 insertions(+), 68 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 1fa8d80..cccebf6 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -1,7 +1,5 @@ name: Release -# A successful CI run on the current main commit is the only release path. -# VERSION sets the next deliberate baseline; later releases increment patch. on: workflow_run: workflows: [CI] @@ -10,6 +8,9 @@ on: permissions: contents: write + id-token: write + attestations: write + artifact-metadata: write concurrency: group: release @@ -17,68 +18,16 @@ concurrency: jobs: release: - runs-on: ubuntu-latest - if: ${{ github.event.workflow_run.conclusion == 'success' }} - - steps: - - name: Checkout - uses: actions/checkout@v7 - with: - fetch-depth: 0 - ref: ${{ github.event.workflow_run.head_sha }} - - - name: Compute release version - id: version - run: | - git fetch origin main --tags - if [ "$(git rev-parse HEAD)" != "$(git rev-parse origin/main)" ]; then - echo "A newer main commit superseded this CI run; nothing to release." - echo "skip=true" >> "$GITHUB_OUTPUT" - exit 0 - fi - if git describe --tags --exact-match --match 'v*.*.*' HEAD >/dev/null 2>&1; then - echo "HEAD is already tagged; nothing to release." - echo "skip=true" >> "$GITHUB_OUTPUT" - exit 0 - fi - - BASE_VERSION=$(tr -d '[:space:]' < VERSION) - if ! echo "$BASE_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then - echo "VERSION must contain a semantic version without a leading v." >&2 - exit 1 - fi - BASE_TAG="v$BASE_VERSION" - LATEST=$(git tag --list 'v*.*.*' | sort -V | tail -n 1) - if [ -z "$LATEST" ]; then - TAG="$BASE_TAG" - elif [ "$LATEST" != "$BASE_TAG" ] && [ "$(printf '%s\n%s\n' "$LATEST" "$BASE_TAG" | sort -V | tail -n 1)" = "$BASE_TAG" ]; then - TAG="$BASE_TAG" - else - TAG=$(echo "$LATEST" | awk -F '[v.]' '{printf "v%d.%d.%d", $2, $3, $4 + 1}') - fi - echo "tag=$TAG" >> "$GITHUB_OUTPUT" - - - name: Create and push tag - if: ${{ steps.version.outputs.skip != 'true' }} - run: | - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - git tag "${{ steps.version.outputs.tag }}" - git push origin "${{ steps.version.outputs.tag }}" - - - name: Set up Go - if: ${{ steps.version.outputs.skip != 'true' }} - uses: actions/setup-go@v7 - with: - go-version: 1.26.x - check-latest: true - - - name: Run goreleaser - if: ${{ steps.version.outputs.skip != 'true' }} - uses: goreleaser/goreleaser-action@v7 - with: - distribution: goreleaser - version: "~> v2" - args: release --clean - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + if: >- + ${{ + github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.event == 'push' && + github.event.workflow_run.head_repository.full_name == github.repository + }} + uses: open-ships/ci/.github/workflows/release-go.yaml@564eb8691843720c6d9eb99d79dba7f3b437c0bc + with: + commit-sha: ${{ github.event.workflow_run.head_sha }} + project-name: n2k-cli + distribution: goreleaser + go-version: 1.26.5 + release-title-with-date: true diff --git a/README.md b/README.md index 96427fa..483175e 100644 --- a/README.md +++ b/README.md @@ -205,7 +205,9 @@ just secure Releases follow semantic versioning. [`VERSION`](VERSION) declares the release baseline, and fully green release automation publishes the tag and prebuilt -binaries. +binaries. GoReleaser builds remain project-owned, while the SHA-pinned shared +Open Ships release policy publishes checksums, an SBOM, toolchain evidence, and +separate build-provenance and SBOM attestations for the platform archives. ## License From 73fed56626a4f09d0a2a345b4cba6b49a0d3d3f9 Mon Sep 17 00:00:00 2001 From: Jake Thomas Date: Mon, 10 Aug 2026 14:22:00 -0400 Subject: [PATCH 2/5] ci: pin shared release policy v1.0.0 --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index cccebf6..10082fb 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -24,7 +24,7 @@ jobs: github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository }} - uses: open-ships/ci/.github/workflows/release-go.yaml@564eb8691843720c6d9eb99d79dba7f3b437c0bc + uses: open-ships/ci/.github/workflows/release-go.yaml@57a20d38b43f01b49d02b82cae004e57f49edaa2 # v1.0.0 with: commit-sha: ${{ github.event.workflow_run.head_sha }} project-name: n2k-cli From 7fccee5fc19a579ad803acd772f20fa4317dd605 Mon Sep 17 00:00:00 2001 From: Jake Thomas Date: Mon, 10 Aug 2026 14:24:08 -0400 Subject: [PATCH 3/5] ci: pin shared release policy v1.0.1 --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 10082fb..b3ba046 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -24,7 +24,7 @@ jobs: github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository }} - uses: open-ships/ci/.github/workflows/release-go.yaml@57a20d38b43f01b49d02b82cae004e57f49edaa2 # v1.0.0 + uses: open-ships/ci/.github/workflows/release-go.yaml@03b777ffa299dd633f3e64301c6f2e00e75c432f # v1.0.1 with: commit-sha: ${{ github.event.workflow_run.head_sha }} project-name: n2k-cli From 4cbf7e14afdf2fc9bccf9eb3bbae9f96bf890bdc Mon Sep 17 00:00:00 2001 From: Jake Thomas Date: Mon, 10 Aug 2026 14:26:34 -0400 Subject: [PATCH 4/5] ci: reference release policy v1.0.1 --- .github/workflows/release.yaml | 2 +- README.md | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index b3ba046..bda4957 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -24,7 +24,7 @@ jobs: github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository }} - uses: open-ships/ci/.github/workflows/release-go.yaml@03b777ffa299dd633f3e64301c6f2e00e75c432f # v1.0.1 + uses: open-ships/ci/.github/workflows/release-go.yaml@v1.0.1 with: commit-sha: ${{ github.event.workflow_run.head_sha }} project-name: n2k-cli diff --git a/README.md b/README.md index 483175e..3dc7625 100644 --- a/README.md +++ b/README.md @@ -205,9 +205,10 @@ just secure Releases follow semantic versioning. [`VERSION`](VERSION) declares the release baseline, and fully green release automation publishes the tag and prebuilt -binaries. GoReleaser builds remain project-owned, while the SHA-pinned shared -Open Ships release policy publishes checksums, an SBOM, toolchain evidence, and -separate build-provenance and SBOM attestations for the platform archives. +binaries. GoReleaser builds remain project-owned, while the exact-version-tagged +shared Open Ships release policy publishes checksums, an SBOM, toolchain +evidence, and separate build-provenance and SBOM attestations for the platform +archives. ## License From 44f3251c146980636176804f11a1fa9e1a172e77 Mon Sep 17 00:00:00 2001 From: Jake Thomas Date: Mon, 10 Aug 2026 14:31:26 -0400 Subject: [PATCH 5/5] ci: reference release policy v1.1.0 --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index bda4957..d089e93 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -24,7 +24,7 @@ jobs: github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository }} - uses: open-ships/ci/.github/workflows/release-go.yaml@v1.0.1 + uses: open-ships/ci/.github/workflows/release-go.yaml@v1.1.0 with: commit-sha: ${{ github.event.workflow_run.head_sha }} project-name: n2k-cli