eric/audita
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Use the tagged module selection for CI delivery

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-07 23:45:27 +00:00
parent bd62f360a7
commit 17421bc5f3
4 changed files with 281 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
docs/release.md
View File

@@ -19,9 +19,10 @@ GOWORK=off GOTOOLCHAIN=local go mod download
```
If dependency preparation changes `go.mod` or `go.sum`, include those changes in
the committed candidate. The release wrapper separately bootstraps the pinned
ReleaseKit command into ignored `bin/releasekit`; that build is tool preparation,
not candidate validation.
the committed candidate. The release wrapper separately builds the ReleaseKit
version selected by `go.mod` into ignored `bin/releasekit`. It uses temporary
copies of `go.mod` and `go.sum` for tool dependency preparation; that build is
tool preparation, not candidate validation.
## Prepare and publish the candidate
@@ -71,29 +72,36 @@ profile, or version input error; and `3` means the push outcome remains unknown.
## Binary delivery
Woodpecker runs the pinned ReleaseKit `ci-deliver` command for tags under
`refs/tags/v*`. It verifies the triggering commit against the tag, prepares the
tagged source, and uses `releasekit.json` to build and deliver:
Woodpecker runs ReleaseKit's `ci-deliver` command for tags under
`refs/tags/v*`. The tagged `go.mod` selects the ReleaseKit version, and
`releasekit.json` supplies Audita's build and delivery settings:
- `audita-<version>-linux-amd64`
- `audita-<version>-linux-arm64`
- `SHA256SUMS`
The workflow invokes:
Before running Go, the workflow fetches and verifies the event tag, checks it
out detached, and confirms the source tree is clean. It copies the tagged
`go.mod` and `go.sum` into temporary module metadata outside the checkout. Go
confirms that this configuration selects ReleaseKit, then builds its CLI using
an alternate `-modfile`. The bootstrap executable and temporary files remain
outside the tagged source. The workflow runs with the existing Go 1.25.5 image,
`GOWORK=off`, and `GOTOOLCHAIN=local`.
The resulting executable receives:
```sh
go run gitea.maximumdirect.net/eric/ReleaseKit/cmd/releasekit@${RELEASEKIT_VERSION} ci-deliver \
"$${bootstrap_dir}/releasekit" ci-deliver \
--repo "$${CI_WORKSPACE}" \
--commit "$${CI_COMMIT_SHA}" \
"$${CI_COMMIT_TAG}"
```
Woodpecker sets `RELEASEKIT_VERSION` to `v0.1.0` for this workflow.
The complete checked-in release note, including its licensing footer, supplies
the hosted release body. The workflow maps the existing `GITEA_RELEASE_TOKEN`
secret to `RELEASEKIT_GITEA_TOKEN`. Delivery runs independently after source
publication; its status and logs report delivery progress or failure.
The workflow maps the existing `GITEA_RELEASE_TOKEN` secret to
`RELEASEKIT_GITEA_TOKEN`. The complete checked-in release note, including its
licensing footer, supplies the hosted release body. Delivery runs independently
after source publication; its status and logs report delivery progress or
failure.
ReleaseKit handles content-aware retries and retained-artifact recovery. See
the pinned [publication recovery guide](https://gitea.maximumdirect.net/eric/ReleaseKit/src/tag/v0.1.0/docs/consumers/publish.md)