Commit Graph

42 Commits

Author SHA1 Message Date
Micheal Wilkinson
c0b5ec385c fix(release): normalize wrapped release-id before asset upload
Some checks failed
Push Validation / recommend-release (push) Has been cancelled
Push Validation / coverage-badge (push) Has been cancelled
Teacup can wrap workflow outputs as %touch docker-compose.yml(string=...), which produced an
invalid releases/{id}/assets URL and a 404 in Upload release binaries.
Unwrap and validate release-id before building the API path.
2026-03-21 20:03:00 +00:00
Micheal Wilkinson
84f6fbcfc8 fix(release): unwrap teacup token inputs and correct failure summary
Some checks failed
Push Validation / recommend-release (push) Has been cancelled
Push Validation / coverage-badge (push) Has been cancelled
Normalize %touch docker-compose.yml(string=...) wrapped token values in publish composite before
API calls. This prevents malformed Authorization headers under teacup.
Also only print 'Release Published' summary when the publish step succeeds,
and print a failure summary otherwise.
2026-03-21 19:51:26 +00:00
Micheal Wilkinson
993768ae9b refactor(release): inline release and validate jobs into prepare-release
All checks were successful
Push Validation / coverage-badge (push) Successful in 1m24s
Push Validation / recommend-release (push) Successful in 42s
Replaces the workflow_call to do-release with directly inlined release
and validate jobs. All steps now appear flat in the Actions UI with full
individual step visibility instead of being collapsed under a setup job.

Tag resolution in the release job is simplified: the tag always comes
from needs.prepare.outputs.tag, removing the detect-tag guessing needed
for standalone dispatch.

do-release.yml is unchanged and remains available for manual dispatch.
2026-03-21 19:30:53 +00:00
Micheal Wilkinson
624b9d154c fix(release): re-enable workflow_call publish path in prepare-release
All checks were successful
Push Validation / coverage-badge (push) Successful in 1m18s
Push Validation / recommend-release (push) Successful in 23s
Tag push events never fire on this Gitea 1.25.x instance (confirmed
across 159 workflow run history). The workflow_call path is reliable and
has worked consistently. Remove the temporary if-false guard.
2026-03-21 19:23:31 +00:00
Micheal Wilkinson
53a097784e chore(workflows): use go-version-file for setup-go
All checks were successful
Push Validation / coverage-badge (push) Successful in 1m14s
Push Validation / recommend-release (push) Successful in 23s
2026-03-21 16:26:16 +00:00
Micheal Wilkinson
511110f466 chore(release): temporarily disable inline do-release call
All checks were successful
Push Validation / coverage-badge (push) Successful in 1m10s
Push Validation / recommend-release (push) Successful in 26s
Disable the publish job in prepare-release to validate that tag push triggers do-release automatically via workflow trigger path.
2026-03-21 16:19:22 +00:00
Micheal Wilkinson
d5170b6874 fix(release): require RELEASE_PAT for tag and release updates
All checks were successful
Push Validation / coverage-badge (push) Successful in 1m11s
Push Validation / recommend-release (push) Successful in 24s
Stop using GITHUB_TOKEN/GITEA_TOKEN fallbacks in prepare/do-release/publish mutation paths. Require explicit PAT wiring via secrets.RELEASE_PAT for commit/push/tag and release update operations so downstream workflows trigger reliably.
2026-03-21 16:17:17 +00:00
Micheal Wilkinson
d65af508a3 chore(go): avoid setup-go stable resolution in ci 2026-03-21 16:08:49 +00:00
Micheal Wilkinson
eae70bb20f fix(workflows): prefer caller tag in do-release resolution
Some checks failed
Push Validation / coverage-badge (push) Failing after 38s
Push Validation / recommend-release (push) Has been skipped
Handle Teacup workflow_call input forwarding gaps by using needs.prepare.outputs.tag as a fallback and normalizing %touch docker-compose.yml(string=...) wrappers before selecting the release tag.
2026-03-21 16:04:26 +00:00
Micheal Wilkinson
a6d57e4048 fix(workflows): prioritize HEAD tag detection over global latest tag
When prepare-release tags HEAD with a new release version, do-release should
immediately detect that tag rather than finding the latest tag chronologically.

Changes:
- Modified detect-tag step to check if HEAD is exactly at a tag first
- Falls back to latest tag only if HEAD is not tagged
- Fixes issue where v1.0.2 was detected instead of v1.1.0 at HEAD

This ensures correct version detection in prepare-release → do-release workflow chain.
2026-03-21 15:58:25 +00:00
Micheal Wilkinson
acca6adacc fix(release): add tag detection fallback for workflow_call input issues 2026-03-21 15:53:02 +00:00
Micheal Wilkinson
ea1b333da3 fix(release): fetch tags before version resolution to support workflow_call from prepare-release 2026-03-21 15:46:47 +00:00
Micheal Wilkinson
cddcf99873 fix(release): resolve version before publish to support workflow_call context 2026-03-21 15:40:16 +00:00
Micheal Wilkinson
ad3d657db9 fix(ci): self-heal module cache on verify failure 2026-03-21 15:33:27 +00:00
Micheal Wilkinson
5bea62b8cf fix(ci): restore cached gosec binary in workflows 2026-03-21 15:15:06 +00:00
Micheal Wilkinson
38afdeffa0 fix(ci): run gosec via go install to use setup-go toolchain 2026-03-21 15:14:00 +00:00
Micheal Wilkinson
5793a58888 fix(ci): add GOTOOLCHAIN=auto to gosec and govulncheck steps 2026-03-21 15:10:44 +00:00
Micheal Wilkinson
76508355be fix(ci): correct govulncheck-action tag to v1.0.4 2026-03-21 15:05:23 +00:00
Micheal Wilkinson
32a6ded499 fix(ci): pin gosec and govulncheck-action to concrete version tags 2026-03-21 15:00:34 +00:00
Micheal Wilkinson
383aad48be chore(go): inject release service dependencies and mirror local validation 2026-03-21 14:12:15 +00:00
Micheal Wilkinson
7cb7b050db chore: add missing CI validation checks (fmt, mod, gosec, govulncheck)
- Add go fmt validation to enforce consistent code formatting
- Add go mod tidy and verify checks for module hygiene
- Add gosec security analysis for static security scanning
- Add govulncheck for dependency vulnerability detection
- Reorganize regex variables with clarifying comments
- Follows documented validation sequence from copilot-instructions.md
2026-03-21 14:04:35 +00:00
Micheal Wilkinson
3e03382781 chore(ci): add preflight token and API checks
All checks were successful
Push Validation / coverage-badge (push) Successful in 50s
Push Validation / recommend-release (push) Successful in 17s
2026-03-21 13:06:15 +00:00
Micheal Wilkinson
43018ae9ac chore: support both GITHUB_TOKEN and GITEA_TOKEN in do-release workflow
All checks were successful
Push Validation / coverage-badge (push) Successful in 56s
Push Validation / recommend-release (push) Successful in 14s
2026-03-21 12:57:40 +00:00
Micheal Wilkinson
f314d7da1b feat: sync docs action tags during prepare 2026-03-21 00:29:14 +00:00
Micheal Wilkinson
16274ea1e5 feat: add reusable coverage-badge action 2026-03-21 00:18:21 +00:00
Micheal Wilkinson
33e1d7c9cc fix: replace workflow step summaries
All checks were successful
Push Validation / validate (push) Successful in 1m46s
2026-03-21 00:03:26 +00:00
Micheal Wilkinson
a139417f02 feat: emit protocol-relative display urls 2026-03-20 23:56:42 +00:00
Micheal Wilkinson
c4f643c39b fix: validate released binary against tagged changelog state 2026-03-20 23:17:27 +00:00
Micheal Wilkinson
68e4211fbf ci: publish coverage artefacts and add badge
All checks were successful
Push Validation / validate (push) Successful in 1m45s
2026-03-20 22:00:11 +00:00
Micheal Wilkinson
be4f3833a1 feat: chain do-release from prepare workflow
- Update prepare-release to call do-release via workflow_call after tag creation.
- Update README examples and release-flow docs to reflect direct invocation
  instead of relying only on tag-push triggers.
2026-03-20 21:46:36 +00:00
Micheal Wilkinson
d63bfca291 fix: close prepare-release summary step block
All checks were successful
Push Validation / validate (push) Successful in 58s
2026-03-20 21:20:26 +00:00
Micheal Wilkinson
bab7b74da8 refactor: internalize auth and cache token wiring in prepare flow
- Remove token and cache-token from public action inputs
- Always use github.token internally for downloads/push
- Read fixed cache token from VOCIFERATE_CACHE_TOKEN env
- Add explicit 'Resolve cache token' step before prepare/tag in
  prepare-release workflow and pass it via env
2026-03-20 20:47:19 +00:00
Micheal Wilkinson
011cca2334 feat: add repository-scoped cache token for action binaries
Add a new optional cache-token input to both published actions.

- Default cache key token is now action_repository + release_tag.
- Cache key uses this token plus runner architecture.
- prepare-release workflow passes github.sha as a fixed token.

This prevents cross-repository cache collisions when consumers pull
vociferate binaries produced by this repository.
2026-03-20 20:40:56 +00:00
Micheal Wilkinson
647d8cf76f feat: add prepare and publish composite actions
Add two focused subdirectory composite actions:

- prepare/action.yml: downloads the vociferate binary, runs it to update
  changelog and release-version, then commits, tags, and pushes — replacing
  the boilerplate git steps consumers previously had to write inline.

- publish/action.yml: extracts the matching changelog section and creates or
  updates the Gitea/GitHub release. Outputs release-id, tag, and version so
  consumers can upload their own assets after it runs.

Simplify the vociferate workflows to use ./prepare and ./publish directly,
validating both actions in the self-release pipeline.

Update README to show the clean two-action usage pattern.
2026-03-20 20:27:22 +00:00
Micheal Wilkinson
c859a3fccb ci: split prepare and publish into separate release pipelines
All checks were successful
Push Validation / validate (push) Successful in 54s
- Remove publish steps (release creation, binary build/upload) from the
  Prepare Release workflow; it now stops after committing and pushing the
  tag.
- Add Do Release workflow triggered on v*.*.* tag pushes; reads release
  notes from the tagged changelog section, creates or updates the release,
  builds linux/amd64 and linux/arm64 binaries, uploads assets, then
  smoke-tests both binaries in a follow-on validate job.
- Remove the standalone Action Validation workflow; binary validation now
  runs as a second job in Do Release after the release job succeeds, using
  the exact tag and version just published.
- Update README to document the two-workflow release model and add split
  prepare/publish usage examples for both the composite action and the
  reusable workflows.
- Update changelog unreleased section to reflect the new pipeline split
  and corrected artifact scope (linux/amd64 and linux/arm64 only).
2026-03-20 19:55:03 +00:00
Micheal Wilkinson
2646d42523 feat: default to release-version file
Some checks failed
Action Validation / validate-released-binary (amd64, ./vociferate, X64) (push) Failing after 6s
Action Validation / validate-released-binary (arm64, qemu-aarch64-static ./vociferate, ARM64) (push) Failing after 23s
Push Validation / validate (push) Successful in 52s
2026-03-20 19:32:49 +00:00
Micheal Wilkinson
a413385c4e feat: cache release binary in action 2026-03-20 19:28:02 +00:00
Micheal Wilkinson
5cb0010531 chore: make releases workflow-only 2026-03-20 19:23:43 +00:00
Micheal Wilkinson
8fefbf1997 refactor: rename releaseprep to vociferate 2026-03-20 19:16:51 +00:00
Micheal Wilkinson
8fadb8299c ci(release): upsert release and replace matching assets
All checks were successful
Push Validation / validate (push) Successful in 52s
2026-03-20 18:43:49 +00:00
Micheal Wilkinson
71e411e12d ci(release): make release notes idempotent and publish binaries 2026-03-20 18:43:49 +00:00
Micheal Wilkinson
caf0b6db76 feat(releaseprep): migrate standalone tool into vociferate 2026-03-20 18:26:11 +00:00