Migrate CI to ReleaseKit delivery

.woodpecker/release.yml

@@ -1,26 +1,21 @@
+matrix:
+  include:
+    - GO_IMAGE: golang:1.25.5
+      RELEASEKIT_VERSION: v0.1.0
+
 when:
   - event: tag
+    ref: refs/tags/v*
 
 steps:
-  - name: build-release-assets
-    image: golang:1.25.5
-    commands:
-      - bash scripts/build-release.sh "$CI_COMMIT_TAG" dist
-
-  - name: publish-release
-    image: woodpeckerci/plugin-release
-    depends_on:
-      - build-release-assets
-    settings:
-      api_key:
+  - name: deliver
+    image: ${GO_IMAGE}
+    environment:
+      RELEASEKIT_GITEA_TOKEN:
         from_secret: GITEA_RELEASE_TOKEN
-      files:
-        - dist/audita-*-linux-amd64
-        - dist/audita-*-linux-arm64
-      note: docs/releases/${CI_COMMIT_TAG}.md
-      checksum: sha256
-      checksum-file: SHA256SUMS
-      checksum-flatten: true
-      file-exists: skip
-      overwrite: false
-      prerelease: false
+    commands:
+      - |
+        go run gitea.maximumdirect.net/eric/ReleaseKit/cmd/releasekit@${RELEASEKIT_VERSION} ci-deliver \
+          --repo "$${CI_WORKSPACE}" \
+          --commit "$${CI_COMMIT_SHA}" \
+          "$${CI_COMMIT_TAG}"

docs/roadmap/implementation.md

@@ -1,7 +1,7 @@
 # Implementation Plan: ReleaseKit Adoption
 
 **Last updated:** 2026-10-07
-**Status:** Stages 1–2 complete; Stages 3–5 pending.
+**Status:** Stages 1–3 complete; Stages 4–5 pending.
 **Audience:** Luna coding agent.
 
 ## Scope and Execution
@@ -160,7 +160,7 @@ the publication test matrix with focused wrapper and profile checks. Checks
 passed: `go test ./scripts`, `bash scripts/release.sh version`, ignored-output
 verification for `bin/releasekit`, and `git diff --check`.
 
-## Stage 3 — Migrate Woodpecker Delivery and Retire the Builder
+## Stage 3 — Migrate Woodpecker Delivery and Retire the Builder [x]
 
 **Primary files:** `.woodpecker/release.yml` and deletion of
 `scripts/build-release.sh`.
@@ -199,6 +199,12 @@ and profile together, and run `git diff --check`. Commit the delivery migration.
 The existing Go image must provide compatible Go and Git; real runner execution
 is observed during subsequent delivery, independently of source completion.
 
+**Completed 2026-10-07:** Migrated Woodpecker to the pinned managed
+`ci-deliver` step using the existing secret, then removed the obsolete binary
+builder. Verified the parsed workflow settings and command against the pinned
+template, confirmed the module/workflow pins match, ran `go test ./scripts`,
+checked for active builder references, and passed `git diff --check`.
+
 ## Stage 4 — Align Policy, Documentation, and Attribution
 
 **Primary files:** `docs/release.md`, `docs/policy/release.md`, `docs/cli.md`,

scripts/build-release.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [[ $# != 2 || ! $1 =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
-  echo 'Usage: scripts/build-release.sh vMAJOR.MINOR.PATCH OUTPUT_DIRECTORY' >&2
-  exit 2
-fi
-version=$1
-output=$2
-mkdir -p "$output"
-output=$(cd "$output" && pwd)
-cd "$(dirname "$0")/.."
-for arch in amd64 arm64; do
-  CGO_ENABLED=0 GOOS=linux GOARCH=$arch GOWORK=off \
-    go build -mod=readonly -trimpath -ldflags '-s -w' \
-    -o "$output/audita-$version-linux-$arch" ./cmd/audita
-done