release: prepare v1.2.0

docs: update upx fallback note
chore(workflows): install upx via ghaction-upx
2026-03-21 23:15:26 +00:00 · 2026-03-21 23:12:30 +00:00 · 2026-03-21 23:12:30 +00:00 · 2026-03-21 23:02:35 +00:00 · 2026-03-21 23:02:29 +00:00 · 2026-03-21 23:00:08 +00:00
19 changed files with 1445 additions and 280 deletions
--- a/.gitea/workflows/prepare-release.yml
+++ b/.gitea/workflows/prepare-release.yml
@@ -1,159 +0,0 @@
 name: Prepare Release
 on:
  workflow_dispatch:
    inputs:
      version:
        description: Optional semantic version override, with or without leading v. When omitted, the recommended version is used.
        required: false
  workflow_call:
    inputs:
      version:
        description: Optional semantic version override, with or without leading v. When omitted, the recommended version is used.
        required: false
        default: ''
        type: string
 jobs:
  prepare:
    runs-on: ubuntu-latest
    container: docker.io/catthehacker/ubuntu:act-latest
    outputs:
      tag: ${{ steps.prepare.outputs.version }}
    defaults:
      run:
        shell: bash
    env:
      SUMMARY_FILE: ${{ runner.temp }}/prepare-release-summary.md
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.26.1'
          check-latest: false
          cache: true
          cache-dependency-path: go.sum
      - name: Validate formatting
        run: test -z "$(gofmt -l .)"
      - name: Module hygiene
        run: |
          set -euo pipefail
          go mod tidy
          if ! go mod verify; then
            echo "go mod verify failed; refreshing module cache and retrying" >&2
            go clean -modcache
            go mod download
            go mod verify
          fi
      - name: Restore cached gosec binary
        id: cache-gosec
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/gosec-bin
          key: gosec-v2.22.4-${{ runner.os }}-${{ runner.arch }}
      - name: Install gosec binary
        if: steps.cache-gosec.outputs.cache-hit != 'true'
        run: |
          set -euo pipefail
          mkdir -p "${RUNNER_TEMP}/gosec-bin"
          GOBIN="${RUNNER_TEMP}/gosec-bin" go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4
      - name: Run gosec security analysis
        run: |
          set -euo pipefail
          "${RUNNER_TEMP}/gosec-bin/gosec" ./...
      - name: Run govulncheck
        uses: golang/govulncheck-action@v1.0.4
        with:
          go-version-file: go.mod
          check-latest: false
          go-package: ./...
          cache: true
          cache-dependency-path: go.sum
      - name: Run tests
        run: |
          set -euo pipefail
          go test ./...
      - name: Resolve cache token
        id: cache-token
        run: echo "value=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
      - name: Resolve release tag
        id: resolve-version
        run: |
          set -euo pipefail
          provided_version="$(printf '%s' "${{ inputs.version }}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
          if [[ -z "$provided_version" ]]; then
            release_tag="$(go run ./cmd/vociferate --recommend --root .)"
          elif [[ "$provided_version" == v* ]]; then
            release_tag="$provided_version"
          else
            release_tag="v${provided_version}"
          fi
          echo "tag=${release_tag}" >> "$GITHUB_OUTPUT"
      - name: Update agent docs action tags
        run: |
          set -euo pipefail
          release_tag="${{ steps.resolve-version.outputs.tag }}"
          for file in README.md AGENTS.md; do
            sed -E -i "s/@v[0-9]+\.[0-9]+\.[0-9]+/@${release_tag}/g" "$file"
          done
      - name: Prepare and tag release
        id: prepare
        uses: ./prepare
        env:
          VOCIFERATE_CACHE_TOKEN: ${{ steps.cache-token.outputs.value }}
        with:
          version: ${{ steps.resolve-version.outputs.tag }}
          git-add-files: CHANGELOG.md release-version README.md AGENTS.md
      - name: Summarize prepared release
        run: |
          set -euo pipefail
          tag="${{ steps.prepare.outputs.version }}"
          {
            echo "## Release Prepared"
            echo
            echo "- Tag pushed: ${tag}"
            echo "- Calling Do Release workflow for ${tag}."
          } >> "$SUMMARY_FILE"
      - name: Summary
        if: ${{ always() }}
        run: |
          set -euo pipefail
          echo 'Summary'
          echo
          if [[ -s "$SUMMARY_FILE" ]]; then
            cat "$SUMMARY_FILE"
          else
            echo 'No summary generated.'
          fi
  publish:
    needs: prepare
    uses: ./.gitea/workflows/do-release.yml
    with:
      tag: ${{ needs.prepare.outputs.tag }}
    secrets: inherit
--- a/.gitea/workflows/push-validation.yml
+++ b/.gitea/workflows/push-validation.yml
@@ -30,7 +30,7 @@ jobs:
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
-          go-version: '1.26.1'
+          go-version-file: go.mod
          check-latest: false
          cache: true
          cache-dependency-path: go.sum
@@ -124,7 +124,7 @@ jobs:
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
-          go-version: '1.26.1'
+          go-version-file: go.mod
          check-latest: false
          cache: true
          cache-dependency-path: go.sum
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,466 @@
 name: Release
 on:
  workflow_dispatch:
    inputs:
      version:
        description: Optional semantic version override, with or without leading v. When omitted, the recommended version is used.
        required: false
  workflow_call:
    inputs:
      version:
        description: Optional semantic version override, with or without leading v. When omitted, the recommended version is used.
        required: false
        default: ''
        type: string
 jobs:
  prepare:
    runs-on: ubuntu-latest
    container: docker.io/catthehacker/ubuntu:act-latest
    outputs:
      tag: ${{ steps.prepare.outputs.version }}
    defaults:
      run:
        shell: bash
    env:
      SUMMARY_FILE: ${{ runner.temp }}/release-prepare-summary.md
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          check-latest: false
          cache: true
          cache-dependency-path: go.sum
      - name: Install UPX
        uses: crazy-max/ghaction-upx@v3
        with:
          install-only: true
      - name: Validate formatting
        run: test -z "$(gofmt -l .)"
      - name: Module hygiene
        run: |
          set -euo pipefail
          go mod tidy
          if ! go mod verify; then
            echo "go mod verify failed; refreshing module cache and retrying" >&2
            go clean -modcache
            go mod download
            go mod verify
          fi
      - name: Restore cached gosec binary
        id: cache-gosec
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/gosec-bin
          key: gosec-v2.22.4-${{ runner.os }}-${{ runner.arch }}
      - name: Install gosec binary
        if: steps.cache-gosec.outputs.cache-hit != 'true'
        run: |
          set -euo pipefail
          mkdir -p "${RUNNER_TEMP}/gosec-bin"
          GOBIN="${RUNNER_TEMP}/gosec-bin" go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4
      - name: Run gosec security analysis
        run: |
          set -euo pipefail
          "${RUNNER_TEMP}/gosec-bin/gosec" ./...
      - name: Run govulncheck
        uses: golang/govulncheck-action@v1.0.4
        with:
          go-version-file: go.mod
          check-latest: false
          go-package: ./...
          cache: true
          cache-dependency-path: go.sum
      - name: Run tests
        run: |
          set -euo pipefail
          go test ./...
      - name: Resolve cache token
        id: cache-token
        run: echo "value=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
      - name: Resolve release tag
        id: resolve-version
        run: |
          set -euo pipefail
          provided_version="$(printf '%s' "${{ inputs.version }}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
          if [[ -z "$provided_version" ]]; then
            release_tag="$(go run ./cmd/vociferate --recommend --root .)"
          elif [[ "$provided_version" == v* ]]; then
            release_tag="$provided_version"
          else
            release_tag="v${provided_version}"
          fi
          echo "tag=${release_tag}" >> "$GITHUB_OUTPUT"
      - name: Update agent docs action tags
        run: |
          set -euo pipefail
          release_tag="${{ steps.resolve-version.outputs.tag }}"
          for file in README.md AGENTS.md; do
            sed -E -i "s/@v[0-9]+\.[0-9]+\.[0-9]+/@${release_tag}/g" "$file"
          done
      - name: Prepare and tag release
        id: prepare
        uses: ./prepare
        env:
          VOCIFERATE_CACHE_TOKEN: ${{ steps.cache-token.outputs.value }}
        with:
          version: ${{ steps.resolve-version.outputs.tag }}
          token: ${{ secrets.RELEASE_PAT }}
          git-add-files: CHANGELOG.md release-version README.md AGENTS.md
      - name: Summary
        if: ${{ always() }}
        run: |
          set -euo pipefail
          tag="${{ steps.prepare.outputs.version }}"
          {
            echo "## Release Prepared"
            echo
            echo "- Tag pushed: ${tag}"
          } >> "$SUMMARY_FILE"
          echo 'Summary'
          echo
          if [[ -s "$SUMMARY_FILE" ]]; then
            cat "$SUMMARY_FILE"
          else
            echo 'No summary generated.'
          fi
  release:
    runs-on: ubuntu-latest
    container: docker.io/catthehacker/ubuntu:act-latest
    needs: prepare
    outputs:
      tag: ${{ steps.publish.outputs.tag }}
      version: ${{ steps.publish.outputs.version }}
    defaults:
      run:
        shell: bash
    env:
      RELEASE_TOKEN: ${{ secrets.RELEASE_PAT }}
      SUMMARY_FILE: ${{ runner.temp }}/release-summary.md
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Resolve release version
        id: resolve-version
        env:
          PREPARE_TAG: ${{ needs.prepare.outputs.tag }}
        run: |
          set -euo pipefail
          tag="$(printf '%s' "${PREPARE_TAG}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
          # Unwrap Teacup expression strings if present.
          if [[ "${tag}" =~ ^%\!t\(string=(.*)\)$ ]]; then
            tag="${BASH_REMATCH[1]}"
          fi
          normalized="${tag#v}"
          tag="v${normalized}"
          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
          echo "version=${normalized}" >> "$GITHUB_OUTPUT"
      - name: Checkout release tag
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: refs/tags/${{ steps.resolve-version.outputs.tag }}
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          check-latest: false
          cache: true
          cache-dependency-path: go.sum
      - name: Preflight release API access
        env:
          TAG_NAME: ${{ steps.resolve-version.outputs.tag }}
        run: |
          set -euo pipefail
          if [[ -z "${RELEASE_TOKEN:-}" ]]; then
            echo "No release token available. Set secrets.RELEASE_PAT." >&2
            exit 1
          fi
          api_base="${GITHUB_API_URL:-${GITHUB_SERVER_URL%/}/api/v1}"
          repo_api="${api_base}/repos/${GITHUB_REPOSITORY}"
          curl --fail-with-body -sS \
            -H "Authorization: token ${RELEASE_TOKEN}" \
            -H "Content-Type: application/json" \
            "${repo_api}" >/dev/null
          curl --fail-with-body -sS \
            -H "Authorization: token ${RELEASE_TOKEN}" \
            -H "Content-Type: application/json" \
            "${repo_api}/releases?limit=1" >/dev/null
          if ! git rev-parse --verify --quiet "refs/tags/${TAG_NAME}" >/dev/null; then
            echo "Tag ${TAG_NAME} was not found in the checked out repository." >&2
            exit 1
          fi
      - name: Create or update release
        id: publish
        uses: ./publish
        with:
          token: ${{ secrets.RELEASE_PAT }}
          version: ${{ steps.resolve-version.outputs.version }}
      - name: Build release binaries
        env:
          RELEASE_VERSION: ${{ steps.publish.outputs.version }}
        run: |
          set -euo pipefail
          upx_cmd=""
          if command -v upx >/dev/null 2>&1; then
            upx_cmd=upx
          elif command -v upx-ucl >/dev/null 2>&1; then
            upx_cmd=upx-ucl
          else
            echo "UPX is not available on PATH after install step; continuing without binary compression." >&2
          fi
          mkdir -p dist
          for target in linux/amd64 linux/arm64; do
            os="${target%/*}"
            arch="${target#*/}"
            bin="vociferate_${RELEASE_VERSION}_${os}_${arch}"
            GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags="-s -w" -o "dist/${bin}" ./cmd/vociferate
            if [[ -n "${upx_cmd}" ]]; then
              "${upx_cmd}" --best --lzma "dist/${bin}"
            fi
          done
          (
            cd dist
            shasum -a 256 * > checksums.txt
          )
      - name: Upload release binaries
        env:
          RELEASE_ID: ${{ steps.publish.outputs.release-id }}
          RELEASE_VERSION: ${{ steps.publish.outputs.version }}
        run: |
          set -euo pipefail
          raw_release_id="$(printf '%s' "${RELEASE_ID:-}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
          if [[ "$raw_release_id" =~ ^%\!t\(string=(.*)\)$ ]]; then
            raw_release_id="${BASH_REMATCH[1]}"
          fi
          release_id="$(printf '%s' "$raw_release_id" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
          if ! [[ "$release_id" =~ ^[0-9]+$ ]]; then
            echo "Invalid release id from publish step: '${RELEASE_ID}'" >&2
            exit 1
          fi
          release_detail_api="${GITHUB_API_URL:-${GITHUB_SERVER_URL%/}/api/v1}/repos/${GITHUB_REPOSITORY}/releases/${release_id}"
          if ! curl --fail-with-body -sS \
            -H "Authorization: token ${RELEASE_TOKEN}" \
            -H "Content-Type: application/json" \
            "$release_detail_api" >/dev/null; then
            echo "Resolved release endpoint is not accessible: ${release_detail_api}" >&2
            exit 1
          fi
          release_api="${GITHUB_API_URL:-${GITHUB_SERVER_URL%/}/api/v1}/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets"
          for asset in dist/*; do
            name="$(basename "$asset")"
            assets_json="$(curl -sS --fail-with-body \
              -H "Authorization: token ${RELEASE_TOKEN}" \
              -H "Content-Type: application/json" \
              "${release_api}")"
            escaped_name="$(printf '%s' "$name" | sed 's/[][(){}.^$*+?|\\/]/\\&/g')"
            existing_asset_id="$(printf '%s' "$assets_json" | tr -d '\n' | sed -n "s/.*{\"id\":\([0-9][0-9]*\)[^}]*\"name\":\"${escaped_name}\".*/\1/p")"
            if [[ -n "$existing_asset_id" ]]; then
              curl --fail-with-body \
                -X DELETE \
                -H "Authorization: token ${RELEASE_TOKEN}" \
                -H "Content-Type: application/json" \
                "${release_api}/${existing_asset_id}"
            fi
            curl --fail-with-body \
              -X POST \
              -H "Authorization: token ${RELEASE_TOKEN}" \
              -H "Content-Type: application/octet-stream" \
              "${release_api}?name=${name}" \
              --data-binary "@${asset}"
          done
      - name: Summary
        if: ${{ always() }}
        env:
          TAG_NAME: ${{ steps.publish.outputs.tag }}
          RELEASE_VERSION: ${{ steps.publish.outputs.version }}
          PUBLISH_OUTCOME: ${{ steps.publish.outcome }}
        run: |
          set -euo pipefail
          if [[ "${PUBLISH_OUTCOME}" == "success" ]]; then
            {
              echo "## Release Published"
              echo
              echo "- Tag: ${TAG_NAME}"
              echo "- Release notes sourced from changelog entry ${RELEASE_VERSION}."
              echo "- Published assets: vociferate_${RELEASE_VERSION}_linux_amd64, vociferate_${RELEASE_VERSION}_linux_arm64, checksums.txt"
              echo "- Release binaries are compressed with UPX from crazy-max/ghaction-upx@v3 when available, otherwise uploaded uncompressed."
            } >> "$SUMMARY_FILE"
          else
            {
              echo "## Release Failed"
              echo
              echo "- Tag: ${TAG_NAME:-unknown}"
              echo "- Create or update release step did not complete successfully."
            } >> "$SUMMARY_FILE"
          fi
          echo 'Summary'
          echo
          if [[ -s "$SUMMARY_FILE" ]]; then
            cat "$SUMMARY_FILE"
          else
            echo 'No summary generated.'
          fi
  validate:
    runs-on: ubuntu-latest
    container: docker.io/catthehacker/ubuntu:act-latest
    needs: release
    strategy:
      fail-fast: false
      matrix:
        include:
          - asset_arch: amd64
            run_command: ./vociferate
          - asset_arch: arm64
            run_command: qemu-aarch64-static ./vociferate
    defaults:
      run:
        shell: bash
    env:
      SUMMARY_FILE: ${{ runner.temp }}/validate-summary.md
    steps:
      - name: Checkout tagged revision
        uses: actions/checkout@v4
        with:
          ref: refs/tags/${{ needs.release.outputs.tag }}
      - name: Install arm64 emulator
        if: ${{ matrix.asset_arch == 'arm64' }}
        run: |
          set -euo pipefail
          apt-get update
          apt-get install -y qemu-user-static
      - name: Download released binary
        env:
          TOKEN: ${{ secrets.RELEASE_PAT }}
          TAG_NAME: ${{ needs.release.outputs.tag }}
          RELEASE_VERSION: ${{ needs.release.outputs.version }}
          ASSET_ARCH: ${{ matrix.asset_arch }}
          SERVER_URL: ${{ github.server_url }}
        run: |
          set -euo pipefail
          asset_name="vociferate_${RELEASE_VERSION}_linux_${ASSET_ARCH}"
          asset_url="${SERVER_URL}/aether/vociferate/releases/download/${TAG_NAME}/${asset_name}"
          curl --fail --location \
            -H "Authorization: token ${TOKEN}" \
            -o vociferate \
            "$asset_url"
          chmod +x vociferate
          echo "asset_name=${asset_name}" >> "$GITHUB_ENV"
      - name: Smoke test released binary
        env:
          RUN_COMMAND: ${{ matrix.run_command }}
          TAG_NAME: ${{ needs.release.outputs.tag }}
        run: |
          set -euo pipefail
          ${RUN_COMMAND} --help >/dev/null
          recommend_stderr="$(mktemp)"
          if ${RUN_COMMAND} --recommend --root . >/dev/null 2>"${recommend_stderr}"; then
            echo "Expected --recommend to fail on the tagged release checkout" >&2
            exit 1
          fi
          recommend_error="$(cat "${recommend_stderr}")"
          case "${recommend_error}" in
            *"unreleased section is empty"*)
              ;;
            *)
              echo "Unexpected recommend failure output: ${recommend_error}" >&2
              exit 1
              ;;
          esac
          {
            echo "## Released Binary Validation (${{ matrix.asset_arch }})"
            echo
            echo "- Release tag: ${TAG_NAME}"
            echo "- Asset: ${asset_name}"
            echo "- Binary executed successfully via --help."
            echo "- --recommend failed as expected on the tagged checkout because Unreleased is empty."
          } >> "$SUMMARY_FILE"
      - name: Summary
        if: ${{ always() }}
        run: |
          set -euo pipefail
          echo 'Summary'
          echo
          if [[ -s "$SUMMARY_FILE" ]]; then
            cat "$SUMMARY_FILE"
          else
            echo 'No summary generated.'
          fi
--- a/.gitea/workflows/update-release.yml
+++ b/.gitea/workflows/update-release.yml
@@ -1,4 +1,4 @@
-name: Do Release
+name: Update Release
 on:
  push:
@@ -28,8 +28,8 @@ jobs:
      run:
        shell: bash
    env:
-      RELEASE_TOKEN: ${{ secrets.GITHUB_TOKEN || secrets.GITEA_TOKEN }}
+      RELEASE_TOKEN: ${{ secrets.RELEASE_PAT }}
-      SUMMARY_FILE: ${{ runner.temp }}/do-release-summary.md
+      SUMMARY_FILE: ${{ runner.temp }}/update-release-summary.md
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -59,7 +59,6 @@ jobs:
        id: resolve-version
        env:
          INPUT_TAG: ${{ inputs.tag }}
          CALLER_TAG: ${{ needs.prepare.outputs.tag }}
          DETECTED_TAG: ${{ steps.detect-tag.outputs.detected_tag }}
        run: |
          set -euo pipefail
@@ -79,17 +78,11 @@ jobs:
          }
          input_tag="$(normalize_candidate "${INPUT_TAG}")"
          caller_tag="$(normalize_candidate "${CALLER_TAG}")"
          detected_tag="$(normalize_candidate "${DETECTED_TAG}")"
          # Try explicit input first.
          requested_tag="$input_tag"
          # Fall back to caller workflow output when workflow_call input forwarding is unreliable.
          if [[ -z "$requested_tag" && -n "$caller_tag" ]]; then
            requested_tag="$caller_tag"
          fi
          # Fall back to detected tag if neither input nor caller tag is available.
          if [[ -z "$requested_tag" && -n "$detected_tag" ]]; then
            requested_tag="$detected_tag"
@@ -107,7 +100,6 @@ jobs:
          else
            echo "Error: Could not resolve release version" >&2
            echo "  - inputs.tag(raw): '$INPUT_TAG'" >&2
            echo "  - needs.prepare.outputs.tag(raw): '$CALLER_TAG'" >&2
            echo "  - detected_tag(raw): '${DETECTED_TAG}'" >&2
            echo "  - GITHUB_REF: '$GITHUB_REF'" >&2
            exit 1
@@ -125,11 +117,16 @@ jobs:
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
-          go-version: '1.26.1'
+          go-version-file: go.mod
          check-latest: false
          cache: true
          cache-dependency-path: go.sum
      - name: Install UPX
        uses: crazy-max/ghaction-upx@v3
        with:
          install-only: true
      - name: Preflight release API access
        env:
          TAG_NAME: ${{ steps.resolve-version.outputs.tag }}
@@ -137,7 +134,7 @@ jobs:
          set -euo pipefail
          if [[ -z "${RELEASE_TOKEN:-}" ]]; then
-            echo "No release token available. Set GITEA_TOKEN (or GITHUB_TOKEN on GitHub)." >&2
+            echo "No release token available. Set secrets.RELEASE_PAT." >&2
            exit 1
          fi
@@ -163,7 +160,7 @@ jobs:
        id: publish
        uses: ./publish
        with:
-          token: ${{ secrets.GITHUB_TOKEN || secrets.GITEA_TOKEN }}
+          token: ${{ secrets.RELEASE_PAT }}
          version: ${{ steps.resolve-version.outputs.version }}
      - name: Build release binaries
@@ -172,6 +169,15 @@ jobs:
        run: |
          set -euo pipefail
          upx_cmd=""
          if command -v upx >/dev/null 2>&1; then
            upx_cmd=upx
          elif command -v upx-ucl >/dev/null 2>&1; then
            upx_cmd=upx-ucl
          else
            echo "UPX is not available on PATH after install step; continuing without binary compression." >&2
          fi
          mkdir -p dist
          for target in linux/amd64 linux/arm64; do
@@ -180,6 +186,9 @@ jobs:
            bin="vociferate_${RELEASE_VERSION}_${os}_${arch}"
            GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags="-s -w" -o "dist/${bin}" ./cmd/vociferate
            if [[ -n "${upx_cmd}" ]]; then
              "${upx_cmd}" --best --lzma "dist/${bin}"
            fi
          done
          (
@@ -194,7 +203,27 @@ jobs:
        run: |
          set -euo pipefail
-          release_api="${GITHUB_API_URL:-${GITHUB_SERVER_URL%/}/api/v1}/repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}/assets"
+          raw_release_id="$(printf '%s' "${RELEASE_ID:-}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
          if [[ "$raw_release_id" =~ ^%\!t\(string=(.*)\)$ ]]; then
            raw_release_id="${BASH_REMATCH[1]}"
          fi
          release_id="$(printf '%s' "$raw_release_id" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
          if ! [[ "$release_id" =~ ^[0-9]+$ ]]; then
            echo "Invalid release id from publish step: '${RELEASE_ID}'" >&2
            exit 1
          fi
          release_detail_api="${GITHUB_API_URL:-${GITHUB_SERVER_URL%/}/api/v1}/repos/${GITHUB_REPOSITORY}/releases/${release_id}"
          if ! curl --fail-with-body -sS \
            -H "Authorization: token ${RELEASE_TOKEN}" \
            -H "Content-Type: application/json" \
            "$release_detail_api" >/dev/null; then
            echo "Resolved release endpoint is not accessible: ${release_detail_api}" >&2
            exit 1
          fi
          release_api="${GITHUB_API_URL:-${GITHUB_SERVER_URL%/}/api/v1}/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets"
          for asset in dist/*; do
            name="$(basename "$asset")"
@@ -223,25 +252,32 @@ jobs:
              --data-binary "@${asset}"
          done
-      - name: Summarize published release
+      - name: Summary
        if: ${{ always() }}
        env:
          TAG_NAME: ${{ steps.publish.outputs.tag }}
          RELEASE_VERSION: ${{ steps.publish.outputs.version }}
          PUBLISH_OUTCOME: ${{ steps.publish.outcome }}
        run: |
          set -euo pipefail
          if [[ "${PUBLISH_OUTCOME}" == "success" ]]; then
            {
              echo "## Release Published"
              echo
              echo "- Tag: ${TAG_NAME}"
              echo "- Release notes sourced from changelog entry ${RELEASE_VERSION}."
              echo "- Published assets: vociferate_${RELEASE_VERSION}_linux_amd64, vociferate_${RELEASE_VERSION}_linux_arm64, checksums.txt"
              echo "- Release binaries are compressed with UPX from crazy-max/ghaction-upx@v3 when available, otherwise uploaded uncompressed."
            } >> "$SUMMARY_FILE"
-
+          else
-      - name: Summary
+            {
-        if: ${{ always() }}
+              echo "## Release Failed"
-        run: |
+              echo
-          set -euo pipefail
+              echo "- Tag: ${TAG_NAME:-unknown}"
              echo "- Create or update release step did not complete successfully."
            } >> "$SUMMARY_FILE"
          fi
          echo 'Summary'
          echo
@@ -268,7 +304,7 @@ jobs:
      run:
        shell: bash
    env:
-      SUMMARY_FILE: ${{ runner.temp }}/do-release-validate-summary.md
+      SUMMARY_FILE: ${{ runner.temp }}/update-release-validate-summary.md
    steps:
      - name: Checkout tagged revision
        uses: actions/checkout@v4
@@ -284,7 +320,7 @@ jobs:
      - name: Download released binary
        env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN || secrets.GITEA_TOKEN }}
+          TOKEN: ${{ secrets.RELEASE_PAT }}
          TAG_NAME: ${{ needs.release.outputs.tag }}
          RELEASE_VERSION: ${{ needs.release.outputs.version }}
          ASSET_ARCH: ${{ matrix.asset_arch }}
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,15 +4,15 @@ This guide is for agentic coding partners that need to integrate the composite a
 ## Source Of Truth
-Pin all action references to a released tag (for example `@v1.0.2`) and keep all vociferate references on the same tag in a workflow.
+Pin all action references to a released tag (for example `@v1.2.0`) and keep all vociferate references on the same tag in a workflow.
 Published composite actions:
- `https://git.hrafn.xyz/aether/vociferate@v1.0.2` (root action)
+- `https://git.hrafn.xyz/aether/vociferate@v1.2.0` (root action)
- `https://git.hrafn.xyz/aether/vociferate/prepare@v1.0.2`
+- `https://git.hrafn.xyz/aether/vociferate/prepare@v1.2.0`
- `https://git.hrafn.xyz/aether/vociferate/publish@v1.0.2`
+- `https://git.hrafn.xyz/aether/vociferate/publish@v1.2.0`
- `https://git.hrafn.xyz/aether/vociferate/coverage-badge@v1.0.2`
+- `https://git.hrafn.xyz/aether/vociferate/coverage-badge@v1.2.0`
- `https://git.hrafn.xyz/aether/vociferate/decorate-pr@v1.0.2`
+- `https://git.hrafn.xyz/aether/vociferate/decorate-pr@v1.2.0`
 ## Action Selection Matrix
@@ -30,8 +30,8 @@ Apply these checks before invoking actions:
 - Checkout repository first.
 - For prepare/publish flows that depend on tags/history, use full history checkout (`fetch-depth: 0`).
- Use valid credentials for release/comment API calls. On GitHub, `secrets.GITHUB_TOKEN` is used; on self-hosted Gitea, set `secrets.GITEA_TOKEN`.
+- Use `secrets.RELEASE_PAT` for release/tag/update operations (`prepare`, `publish`, `release`, `update-release`) so authenticated release changes can be pushed and published reliably.
- `do-release` and `decorate-pr` now run preflight API checks and fail fast when token credentials are missing or insufficient.
+- `release`, `update-release`, and `decorate-pr` run preflight API checks and fail fast when token credentials are missing or insufficient.
 - Set required vars/secrets for coverage uploads:
  - `vars.ARTEFACT_BUCKET_NAME`
  - `vars.ARTEFACT_BUCKET_ENDPONT`
@@ -83,41 +83,26 @@ Minimal template:
 ## Minimal Integration Patterns
-### 1. Prepare Then Publish
+### 1. Full Release Workflow
 ```yaml
 jobs:
  prepare:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - id: prepare
        uses: https://git.hrafn.xyz/aether/vociferate/prepare@v1.0.2
  publish:
    needs: prepare
    uses: https://git.hrafn.xyz/aether/vociferate/.gitea/workflows/do-release.yml@v1.0.2
    with:
      tag: ${{ needs.prepare.outputs.version }}
    secrets: inherit
 ```
 ### 2. Publish Existing Tag
 ```yaml
 jobs:
  release:
-    runs-on: ubuntu-latest
+    uses: https://git.hrafn.xyz/aether/vociferate/.gitea/workflows/release.yml@v1.2.0
    steps:
      - uses: actions/checkout@v4
    with:
-          fetch-depth: 0
+      version: ${{ inputs.version }}
-      - id: publish
+    secrets: inherit
-        uses: https://git.hrafn.xyz/aether/vociferate/publish@v1.0.2
+```
 ### 2. Update Existing Release Tag
 ```yaml
 jobs:
  release:
    uses: https://git.hrafn.xyz/aether/vociferate/.gitea/workflows/update-release.yml@v1.2.0
    with:
-          version: v1.2.3
+      tag: v1.2.3
    secrets: inherit
 ```
 ### 3. Coverage Badge Publication
@@ -136,7 +121,7 @@ jobs:
      - name: Run tests with coverage
        run: go test -covermode=atomic -coverprofile=coverage.out ./...
      - id: badge
-        uses: https://git.hrafn.xyz/aether/vociferate/coverage-badge@v1.0.2
+        uses: https://git.hrafn.xyz/aether/vociferate/coverage-badge@v1.2.0
        with:
          artefact-bucket-name: ${{ vars.ARTEFACT_BUCKET_NAME }}
          artefact-bucket-endpoint: ${{ vars.ARTEFACT_BUCKET_ENDPONT }}
@@ -159,12 +144,12 @@ jobs:
      - name: Run tests with coverage
        run: go test -covermode=atomic -coverprofile=coverage.out ./...
      - id: badge
-        uses: https://git.hrafn.xyz/aether/vociferate/coverage-badge@v1.0.2
+        uses: https://git.hrafn.xyz/aether/vociferate/coverage-badge@v1.2.0
        with:
          artefact-bucket-name: ${{ vars.ARTEFACT_BUCKET_NAME }}
          artefact-bucket-endpoint: ${{ vars.ARTEFACT_BUCKET_ENDPONT }}
      - name: Decorate PR
-        uses: https://git.hrafn.xyz/aether/vociferate/decorate-pr@v1.0.2
+        uses: https://git.hrafn.xyz/aether/vociferate/decorate-pr@v1.2.0
        with:
          coverage-percentage: ${{ steps.badge.outputs.total }}
          badge-url: ${{ steps.badge.outputs.badge-url }}
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,37 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
 ### Added
 ### Changed
 ### Removed
 ### Fixed
 ## [1.2.0] - 2026-03-21
 ### Breaking
 ### Added
 - Extracted `coverage-gate` action and tool from Cue for reuse across Æther projects.
 - Coverage gate now available as reusable composite action with JSON metrics output (`passes`, `total_coverage`, `packages_checked`, `packages_failed`).
 - Support for per-package coverage threshold policy via JSON configuration in `coverage-gate` tool.
 ### Changed
 ### Removed
 ### Fixed
 - Hardened `coverage-gate` file input handling by validating and normalizing policy/profile paths before opening files, resolving `G304` findings in `coverage-gate/parse.go`.
 - Made release binary builds resilient by installing UPX via `crazy-max/ghaction-upx@v3` and falling back to uncompressed artifacts when UPX is still unavailable in both `release.yml` and `update-release.yml`.
 ## [1.1.0] - 2026-03-21
 ### Breaking
 ### Added
 - Added changelog gate validation to `decorate-pr` action for enforcing changelog updates on qualifying code changes.
 - Changelog gate modes: `strict` (fails job on violation) and `soft` (warns via PR comment).
 - Docs-only PR exemption with customizable glob patterns for documentation files.
@@ -30,6 +61,9 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
 - `publish` now extracts tagged release notes through the `vociferate` Go CLI instead of duplicating changelog section parsing in shell.
 - Composite actions now share a centralized `run-vociferate` orchestration flow, with binary-versus-source execution delegated through shared composite actions and single-use runtime/download logic folded back into `run-vociferate.binary`.
 - `run-vociferate` now contains both binary and source execution flows directly in a single action implementation, removing nested local action wrappers for better runner compatibility.
 - Release automation now requires `secrets.RELEASE_PAT` for prepare/publish/do-release operations instead of defaulting to `GITHUB_TOKEN`/`GITEA_TOKEN`.
 - Renamed the reusable Gitea workflows to `release.yml` and `update-release.yml`, and inlined release publication into the main `release` workflow for clearer per-step job output.
 - Release binary builds now compress published linux artifacts with UPX before checksum generation and upload.
 ### Removed
@@ -40,6 +74,7 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
 - Fixed version resolution in `do-release` workflow by moving version calculation before checkout, resolving from inputs/git tags, and always passing explicit version to `publish` action.
 - Fixed tag detection in `do-release` to prioritize the tag at current HEAD (created by `prepare-release`) over the globally latest tag, ensuring correct version is detected when called from `prepare-release` workflow.
 - Fixed `do-release` workflow_call resolution on Teacup runners by explicitly falling back to `needs.prepare.outputs.tag` and normalizing `%!t(string=...)` wrapped values before choosing a release tag.
 - Fixed release-chain triggering by using a PAT for release commit/tag pushes so downstream release workflows are triggered reliably.
 - Made `publish` action version resolution more robust with clearer error messages when version input is missing and workflow is not running from a tag push.
 - Fixed `do-release` workflow to always checkout the resolved release tag, eliminating conditional checkout logic that could skip the checkout when called from `prepare-release` workflow.
 - Pinned `securego/gosec` and `golang/govulncheck-action` to concrete version tags (`v2.22.4` and `v1.0.4`) so self-hosted Gitea runners can resolve them via direct git clone without relying on the GitHub Actions floating-tag API.
@@ -48,6 +83,7 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
 - Fixed nested local composite-action references to use repository-local `./run-vociferate` paths so strict runners do not misparse parent-directory (`../`) action references as malformed remote coordinates.
 - Consolidated `run-vociferate` binary and source execution flows directly into the main `run-vociferate` action to avoid nested local-action path resolution issues on strict runners.
 - Hardened workflow module hygiene by retrying `go mod verify` after a module-cache refresh (`go clean -modcache` + `go mod download`) when runners report modified cached dependency directories.
 - Synced `update-release.yml` with the active release pipeline fixes for Teacup-wrapped outputs, release-id normalization, upload endpoint validation, and accurate success or failure summaries.
 ## [1.0.2] - 2026-03-21
@@ -154,9 +190,11 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
 - Project/automation rename from `releaseprep` to `vociferate` (entrypoint, package paths, outputs).
 - README guidance focused on primary cross-repository reuse workflows.
-[Unreleased]: https://git.hrafn.xyz/aether/vociferate/compare/v1.0.2...main
+[Unreleased]: https://git.hrafn.xyz/aether/vociferate/compare/v1.2.0...main
 [1.2.0]: https://git.hrafn.xyz/aether/vociferate/compare/v1.1.0...v1.2.0
 [1.1.0]: https://git.hrafn.xyz/aether/vociferate/compare/v1.0.2...v1.1.0
 [1.0.2]: https://git.hrafn.xyz/aether/vociferate/compare/v1.0.1...v1.0.2
 [1.0.1]: https://git.hrafn.xyz/aether/vociferate/compare/v1.0.0...v1.0.1
 [1.0.0]: https://git.hrafn.xyz/aether/vociferate/compare/v0.2.0...v1.0.0
 [0.2.0]: https://git.hrafn.xyz/aether/vociferate/compare/v0.1.0...v0.2.0
-[0.1.0]: https://git.hrafn.xyz/aether/vociferate/compare/2060af6...v0.1.0
+[0.1.0]: https://git.hrafn.xyz/aether/vociferate/compare/995e397...v0.1.0
--- a/COMPLIANCE_ANALYSIS.md
+++ b/COMPLIANCE_ANALYSIS.md
@@ -154,8 +154,8 @@ if err != nil {
 **Workflows analyzed:**
 - [push-validation.yml](.gitea/workflows/push-validation.yml)
- [prepare-release.yml](.gitea/workflows/prepare-release.yml)
+- [release.yml](.gitea/workflows/release.yml)
- [do-release.yml](.gitea/workflows/do-release.yml)
+- [update-release.yml](.gitea/workflows/update-release.yml)
 #### What's Implemented
@@ -171,7 +171,7 @@ if err != nil {
 - ✅ Coverage badge publication
 - ✅ Release tag recommendation on `main` branch
-**prepare-release.yml:**
+**release.yml:**
 - ✅ Go setup and caching
 - ✅ Tests run before release preparation
@@ -361,7 +361,7 @@ validate
 **Effort Invested:**
- CI/CD improvements: workflow hardening in `push-validation.yml` and `prepare-release.yml`
+- CI/CD improvements: workflow hardening in `push-validation.yml` and `release.yml`
 - Code organization: injected service boundaries for filesystem, environment, and git access
 - Local automation: `justfile` validation parity for format, modules, tests, and security
 - **Primary commits:** 7cb7b05, 383aad4, 5c903c9
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
 # vociferate
 [![Main Validation](https://git.hrafn.xyz/aether/vociferate/actions/workflows/push-validation.yml/badge.svg?branch=main&event=push)](https://git.hrafn.xyz/aether/vociferate/actions/runs/latest?workflow=push-validation.yml&branch=main&event=push)
-[![Prepare Release](https://git.hrafn.xyz/aether/vociferate/actions/workflows/prepare-release.yml/badge.svg?event=workflow_dispatch)](https://git.hrafn.xyz/aether/vociferate/actions/runs/latest?workflow=prepare-release.yml)
+[![Release](https://git.hrafn.xyz/aether/vociferate/actions/workflows/release.yml/badge.svg?event=workflow_dispatch)](https://git.hrafn.xyz/aether/vociferate/actions/runs/latest?workflow=release.yml)
-[![Do Release](https://git.hrafn.xyz/aether/vociferate/actions/workflows/do-release.yml/badge.svg?event=push)](https://git.hrafn.xyz/aether/vociferate/actions/runs/latest?workflow=do-release.yml)
+[![Update Release](https://git.hrafn.xyz/aether/vociferate/actions/workflows/update-release.yml/badge.svg?event=workflow_dispatch)](https://git.hrafn.xyz/aether/vociferate/actions/runs/latest?workflow=update-release.yml)
 [![Coverage](https://s3.hrafn.xyz/aether-workflow-report-artefacts/vociferate/branch/main/coverage-badge.svg)](https://s3.hrafn.xyz/aether-workflow-report-artefacts/vociferate/branch/main/coverage.html)
 `vociferate` is an `Æther` release orchestration tool written in Go for repositories that
@@ -17,14 +17,14 @@ revision.
 ## Use In Other Repositories
 Vociferate ships composite actions covering release preparation, release publication, coverage badge publishing, and pull request decoration.
-Release tags now exist; pin all action and reusable-workflow references to the same released tag (for example, `@v1.0.2`) instead of `@main`.
+Release tags now exist; pin all action and reusable-workflow references to the same released tag (for example, `@v1.2.0`) instead of `@main`.
 For agentic coding partners, see [`AGENTS.md`](AGENTS.md) for a direct integration playbook, selection matrix, and copy-paste workflow patterns.
 ### `prepare` — update files, commit, and push tag
 ```yaml
-name: Prepare Release
+name: Release
 on:
  workflow_dispatch:
@@ -41,13 +41,13 @@ jobs:
        with:
          fetch-depth: 0
-      - uses: https://git.hrafn.xyz/aether/vociferate/prepare@v1.0.2
+      - uses: https://git.hrafn.xyz/aether/vociferate/prepare@v1.2.0
        with:
          version: ${{ inputs.version }}
  publish:
    needs: prepare
-    uses: https://git.hrafn.xyz/aether/vociferate/.gitea/workflows/do-release.yml@v1.0.2
+    uses: https://git.hrafn.xyz/aether/vociferate/.gitea/workflows/update-release.yml@v1.2.0
    with:
      tag: ${{ needs.prepare.outputs.version }}
    secrets: inherit
@@ -61,20 +61,21 @@ For repositories that embed the version inside source code, pass `version-file`
 and `version-pattern`:
 ```yaml
- uses: https://git.hrafn.xyz/aether/vociferate/prepare@v1.0.2
+- uses: https://git.hrafn.xyz/aether/vociferate/prepare@v1.2.0
  with:
    token: ${{ secrets.RELEASE_PAT }}
    version-file: internal/myapp/version/version.go
    version-pattern: 'const Version = "([^"]+)"'
    git-add-files: CHANGELOG.md internal/myapp/version/version.go
 ```
-`prepare` uses `github.token` internally for authenticated fetch/push operations,
+`prepare` requires a PAT input for authenticated commit/push/tag operations.
-so no token input is required.
+Pass `token: ${{ secrets.RELEASE_PAT }}` when invoking the action.
 ### `publish` — create release with changelog notes
 ```yaml
-name: Do Release
+name: Update Release
 on:
  workflow_dispatch:
@@ -85,7 +86,7 @@ on:
 jobs:
  release:
-    uses: https://git.hrafn.xyz/aether/vociferate/.gitea/workflows/do-release.yml@v1.0.2
+    uses: https://git.hrafn.xyz/aether/vociferate/.gitea/workflows/update-release.yml@v1.2.0
    with:
      tag: ${{ inputs.tag }}
    secrets: inherit
@@ -95,22 +96,21 @@ Reads the matching section from `CHANGELOG.md` and creates or updates the
 Gitea/GitHub release with those notes. The `version` input is optional — when
 omitted it is derived from the current tag ref automatically.
-The reusable `Do Release` workflow now runs preflight checks before publish to
+The reusable `Update Release` workflow now runs preflight checks before publish to
-fail fast when the release token is missing or lacks API access. On
+fail fast when the release token is missing or lacks API access. Set
-self-hosted Gitea, set `secrets.GITEA_TOKEN`; on GitHub, `secrets.GITHUB_TOKEN`
+`secrets.RELEASE_PAT` and use it for prepare/publish release operations.
 is used automatically.
 The `publish` action outputs `release-id` so you can upload additional release
 assets after it runs:
 ```yaml
 - id: publish
-  uses: https://git.hrafn.xyz/aether/vociferate/publish@v1.0.2
+  uses: https://git.hrafn.xyz/aether/vociferate/publish@v1.2.0
 - name: Upload my binary
  run: |
    curl --fail-with-body -X POST \
-      -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+      -H "Authorization: token ${{ secrets.RELEASE_PAT }}" \
      -H "Content-Type: application/octet-stream" \
      "${{ github.api_url }}/repos/${{ github.repository }}/releases/${{ steps.publish.outputs.release-id }}/assets?name=myapp" \
      --data-binary "@dist/myapp"
@@ -125,7 +125,7 @@ Run your coverage tests first, then call the action to generate `coverage.html`,
  run: go test -covermode=atomic -coverprofile=coverage.out ./...
 - id: coverage
-  uses: https://git.hrafn.xyz/aether/vociferate/coverage-badge@v1.0.2
+  uses: https://git.hrafn.xyz/aether/vociferate/coverage-badge@v1.2.0
  with:
    artefact-bucket-name: ${{ vars.ARTEFACT_BUCKET_NAME }}
    artefact-bucket-endpoint: ${{ vars.ARTEFACT_BUCKET_ENDPONT }}
@@ -150,14 +150,14 @@ with a clear message when token permissions are insufficient.
  run: go test -covermode=atomic -coverprofile=coverage.out ./...
 - id: coverage
-  uses: https://git.hrafn.xyz/aether/vociferate/coverage-badge@v1.0.2
+  uses: https://git.hrafn.xyz/aether/vociferate/coverage-badge@v1.2.0
  with:
    artefact-bucket-name: ${{ vars.ARTEFACT_BUCKET_NAME }}
    artefact-bucket-endpoint: ${{ vars.ARTEFACT_BUCKET_ENDPONT }}
 - name: Decorate pull request
  if: github.event_name == 'pull_request'
-  uses: https://git.hrafn.xyz/aether/vociferate/decorate-pr@v1.0.2
+  uses: https://git.hrafn.xyz/aether/vociferate/decorate-pr@v1.2.0
  with:
    coverage-percentage: ${{ steps.coverage.outputs.total }}
    badge-url: ${{ steps.coverage.outputs.badge-url }}
@@ -170,7 +170,7 @@ Enable changelog validation to enforce that code changes include `Unreleased` ch
 ```yaml
 - name: Decorate pull request with changelog gate
  if: github.event_name == 'pull_request'
-  uses: https://git.hrafn.xyz/aether/vociferate/decorate-pr@v1.0.2
+  uses: https://git.hrafn.xyz/aether/vociferate/decorate-pr@v1.2.0
  with:
    coverage-percentage: ${{ steps.coverage.outputs.total }}
    badge-url: ${{ steps.coverage.outputs.badge-url }}
@@ -196,7 +196,7 @@ Decision outputs enable downstream workflow logic:
 - name: Decorate PR and check gate
  id: decorate
  if: github.event_name == 'pull_request'
-  uses: https://git.hrafn.xyz/aether/vociferate/decorate-pr@v1.0.2
+  uses: https://git.hrafn.xyz/aether/vociferate/decorate-pr@v1.2.0
  with:
    coverage-percentage: ${{ steps.coverage.outputs.total }}
    badge-url: ${{ steps.coverage.outputs.badge-url }}
--- a/coverage-gate/README.md
+++ b/coverage-gate/README.md
@@ -0,0 +1,85 @@
 # coveragegate
 Standalone coverage-threshold enforcement tool for this repository.
 This tool is a quality gate. It is not part of Cue runtime orchestration.
 ## What it does
 - Reads a Go coverage profile (for example `_build/coverage.out`).
 - Loads package coverage policy from JSON.
 - Discovers packages under a source root using `go list ./...`.
 - Evaluates per-package statement coverage against policy thresholds.
 - Prints a package table and returns a non-zero exit code when any package fails.
 ## Repository integration
 Primary repository flow:
 1. `just test-coverage` runs tests in `src/` and writes `_build/coverage.out`.
 2. `scripts/check-core-coverage.sh` runs this tool from `tools/coveragegate/`.
 3. The script currently passes:
   - `--profile $ROOT_DIR/_build/coverage.out`
   - `--policy $ROOT_DIR/docs/coverage-thresholds.json`
   - `--src-root $ROOT_DIR/src`
 ## Usage
 From repository root:
 ```bash
 cd tools/coveragegate
 go run . \
  --profile ../../_build/coverage.out \
  --policy ../../docs/coverage-thresholds.json \
  --src-root ../../src
 ```
 Or use the repository wrapper:
 ```bash
 bash scripts/check-core-coverage.sh
 ```
 ## Flags
 - `--profile`: Path to Go coverage profile.
 - `--policy`: Path to JSON policy file.
 - `--src-root`: Directory where packages are discovered with `go list ./...`.
 ## Exit codes
 - `0`: All in-scope packages meet threshold.
 - `1`: Policy/profile/load failure or one or more packages below threshold.
 - `2`: Invalid CLI arguments.
 ## Policy model (current)
 The tool expects a JSON object with at least:
 - `minimum_statement_coverage` (number)
 - `critical_packages` (array)
 Each critical package may include:
 - `package` (string)
 - `minimum_statement_coverage` (number)
 - `include` (boolean)
 - `exclusions` (array of strings)
 Behavior notes:
 - If a package has no policy override, the global minimum is used.
 - Generated/composition files are excluded by built-in rules.
 - Packages with no statements are treated as passing.
 ## Development
 Run tests:
 ```bash
 cd tools/coveragegate
 go test ./...
 ```
 Keep code `gofmt` and `go vet` clean.
--- a/coverage-gate/action.yml
+++ b/coverage-gate/action.yml
@@ -0,0 +1,91 @@
 name: vociferate/coverage-gate
 description: >
  Enforce per-package code coverage thresholds against Go coverage profiles.
  Supports JSON policy files with per-package overrides and global minimums.
 inputs:
  profile:
    description: Path to Go coverage profile file (output from `go test -coverprofile=...`).
    required: false
    default: coverage.out
  policy:
    description: Path to JSON file defining coverage thresholds and per-package overrides.
    required: false
    default: docs/coverage-thresholds.json
  src-root:
    description: Source root directory for package discovery (passed to `go list ./...`).
    required: false
    default: .
  summary-file:
    description: Optional file path to append markdown summary of coverage results.
    required: false
    default: ''
 outputs:
  passed:
    description: 'Boolean: true if all packages meet threshold, false if any failed.'
    value: ${{ steps.gate.outputs.passed }}
  total-coverage:
    description: Repository-wide statement coverage percentage.
    value: ${{ steps.gate.outputs.total_coverage }}
  packages-checked:
    description: Number of packages evaluated against policy.
    value: ${{ steps.gate.outputs.packages_checked }}
  packages-failed:
    description: Number of packages below threshold.
    value: ${{ steps.gate.outputs.packages_failed }}
 runs:
  using: composite
  steps:
    - id: gate
      shell: bash
      working-directory: ${{ github.action_path }}
      env:
        PROFILE: ${{ inputs.profile }}
        POLICY: ${{ inputs.policy }}
        SRC_ROOT: ${{ inputs.src-root }}
        SUMMARY_FILE: ${{ inputs.summary-file }}
      run: |
        set -euo pipefail
        # Run coverage gate and capture output
        EXIT_CODE=0
        OUTPUT=$(go run . \
          --profile "$PROFILE" \
          --policy "$POLICY" \
          --src-root "$SRC_ROOT" \
        ) || EXIT_CODE=$?
        echo "$OUTPUT"
        # Parse summary from output (tool prints JSON stats on last line)
        SUMMARY_LINE=$(echo "$OUTPUT" | tail -1)
        # Determine pass/fail
        if [[ $EXIT_CODE -eq 0 ]]; then
          echo "passed=true" >> "$GITHUB_OUTPUT"
        else
          echo "passed=false" >> "$GITHUB_OUTPUT"
        fi
        # Extract metrics (tool outputs: packages_checked, packages_failed, total_coverage on summary line)
        if echo "$SUMMARY_LINE" | jq . &>/dev/null; then
          echo "total_coverage=$(echo "$SUMMARY_LINE" | jq -r '.total_coverage')" >> "$GITHUB_OUTPUT"
          echo "packages_checked=$(echo "$SUMMARY_LINE" | jq -r '.packages_checked')" >> "$GITHUB_OUTPUT"
          echo "packages_failed=$(echo "$SUMMARY_LINE" | jq -r '.packages_failed')" >> "$GITHUB_OUTPUT"
          # Append to summary file if provided
          if [[ -n "$SUMMARY_FILE" ]]; then
            {
              echo "## Coverage Gate Results"
              echo
              echo "- **Passed:** $([ "$EXIT_CODE" -eq 0 ] && echo '✓ Yes' || echo '✗ No')"
              echo "- **Total Coverage:** $(echo "$SUMMARY_LINE" | jq -r '.total_coverage')%"
              echo "- **Packages Checked:** $(echo "$SUMMARY_LINE" | jq -r '.packages_checked')"
              echo "- **Packages Failed:** $(echo "$SUMMARY_LINE" | jq -r '.packages_failed')"
            } >> "$SUMMARY_FILE"
          fi
        fi
        exit $EXIT_CODE
--- a/coverage-gate/go.mod
+++ b/coverage-gate/go.mod
@@ -0,0 +1,3 @@
 module git.hrafn.xyz/aether/vociferate/coverage-gate
 go 1.26.1
--- a/coverage-gate/integration_test.go
+++ b/coverage-gate/integration_test.go
@@ -0,0 +1,26 @@
 package main
 import (
 	"os"
 	"path/filepath"
 	"testing"
 )
 func TestRun_ExitCodeOnInvalidProfile(t *testing.T) {
 	t.Parallel()
 	tmp := t.TempDir()
 	policyPath := filepath.Join(tmp, "policy.json")
 	if err := os.WriteFile(policyPath, []byte(`{"minimum_statement_coverage":80,"critical_packages":[]}`), 0600); err != nil {
 		t.Fatalf("write policy: %v", err)
 	}
 	exit := run(
 		[]string{"--profile", filepath.Join(tmp, "missing.out"), "--policy", policyPath, "--src-root", "."},
 		os.Stdout,
 		os.Stderr,
 		func(_ string) ([]string, error) { return []string{"git.hrafn.xyz/aether/cue/service/llm"}, nil },
 	)
 	if exit != 1 {
 		t.Fatalf("expected exit 1 for missing profile, got %d", exit)
 	}
 }
--- a/coverage-gate/main.go
+++ b/coverage-gate/main.go
@@ -0,0 +1,118 @@
 package main
 import (
 	"encoding/json"
 	"flag"
 	"fmt"
 	"io"
 	"os"
 	"os/exec"
 	"sort"
 	"strings"
 )
 type discoverPackagesFunc func(srcRoot string) ([]string, error)
 func main() {
 	os.Exit(run(os.Args[1:], os.Stdout, os.Stderr, discoverPackages))
 }
 func run(args []string, stdout io.Writer, stderr io.Writer, discover discoverPackagesFunc) int {
 	fs := flag.NewFlagSet("coveragegate", flag.ContinueOnError)
 	fs.SetOutput(stderr)
 	profilePath := fs.String("profile", "../_build/coverage.out", "path to go coverprofile")
 	policyPath := fs.String("policy", "../specs/003-testing-time/contracts/coverage-thresholds.json", "path to coverage policy json")
 	srcRoot := fs.String("src-root", ".", "path to src workspace root")
 	if err := fs.Parse(args); err != nil {
 		return 2
 	}
 	policy, err := LoadPolicy(*policyPath)
 	if err != nil {
 		fmt.Fprintf(stderr, "coverage gate: %v\n", err)
 		return 1
 	}
 	aggByPkg, err := ParseCoverProfile(*profilePath, policy)
 	if err != nil {
 		fmt.Fprintf(stderr, "coverage gate: %v\n", err)
 		return 1
 	}
 	pkgs, err := discover(*srcRoot)
 	if err != nil {
 		fmt.Fprintf(stderr, "coverage gate: %v\n", err)
 		return 1
 	}
 	results := EvaluateCoverage(pkgs, aggByPkg, policy)
 	if len(results) == 0 {
 		fmt.Fprintln(stderr, "coverage gate: no in-scope packages found")
 		return 1
 	}
 	fmt.Fprintln(stdout, "Package coverage results:")
 	fmt.Fprintln(stdout, "PACKAGE\tCOVERAGE\tTHRESHOLD\tSTATUS")
 	failed := false
 	totalCoverage := 0.0
 	for _, r := range results {
 		status := "PASS"
 		if !r.Pass {
 			status = "FAIL"
 			failed = true
 		}
 		fmt.Fprintf(stdout, "%s\t%.2f%%\t%.2f%%\t%s\n", r.Package, r.Percent, r.Threshold, status)
 		totalCoverage += r.Percent
 	}
 	if len(results) > 0 {
 		totalCoverage /= float64(len(results))
 	}
 	packagesFailed := 0
 	for _, r := range results {
 		if !r.Pass {
 			packagesFailed++
 		}
 	}
 	// Output JSON metrics for CI consumption
 	metrics := map[string]interface{}{
 		"passed":           !failed,
 		"total_coverage":   fmt.Sprintf("%.2f", totalCoverage),
 		"packages_checked": len(results),
 		"packages_failed":  packagesFailed,
 	}
 	metricsJSON, _ := json.Marshal(metrics)
 	fmt.Fprintln(stdout, string(metricsJSON))
 	if failed {
 		fmt.Fprintln(stderr, "coverage gate: one or more packages are below threshold")
 		return 1
 	}
 	fmt.Fprintln(stdout, "coverage gate: all in-scope packages meet threshold")
 	return 0
 }
 func discoverPackages(srcRoot string) ([]string, error) {
 	cmd := exec.Command("go", "list", "./...")
 	cmd.Dir = srcRoot
 	out, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("discover packages with go list: %w", err)
 	}
 	lines := strings.Split(strings.TrimSpace(string(out)), "\n")
 	pkgs := make([]string, 0, len(lines))
 	for _, line := range lines {
 		line = strings.TrimSpace(line)
 		if line == "" {
 			continue
 		}
 		pkgs = append(pkgs, line)
 	}
 	sort.Strings(pkgs)
 	return pkgs, nil
 }
--- a/coverage-gate/main_test.go
+++ b/coverage-gate/main_test.go
@@ -0,0 +1,85 @@
 package main
 import (
 	"bytes"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 func TestRun_FailsWhenBelowThreshold(t *testing.T) {
 	t.Parallel()
 	tmp := t.TempDir()
 	policyPath := filepath.Join(tmp, "policy.json")
 	profilePath := filepath.Join(tmp, "coverage.out")
 	policy := `{
  "minimum_statement_coverage": 80,
  "critical_packages": []
 }`
 	if err := os.WriteFile(policyPath, []byte(policy), 0600); err != nil {
 		t.Fatalf("write policy: %v", err)
 	}
 	profile := "mode: set\n" +
 		"git.hrafn.xyz/aether/cue/service/llm/validator.go:1.1,2.1 10 0\n"
 	if err := os.WriteFile(profilePath, []byte(profile), 0600); err != nil {
 		t.Fatalf("write profile: %v", err)
 	}
 	var out bytes.Buffer
 	var errOut bytes.Buffer
 	exit := run(
 		[]string{"--profile", profilePath, "--policy", policyPath, "--src-root", "."},
 		&out,
 		&errOut,
 		func(_ string) ([]string, error) {
 			return []string{"git.hrafn.xyz/aether/cue/service/llm"}, nil
 		},
 	)
 	if exit != 1 {
 		t.Fatalf("expected exit 1, got %d\nstdout: %s\nstderr: %s", exit, out.String(), errOut.String())
 	}
 	if !strings.Contains(errOut.String(), "below threshold") {
 		t.Fatalf("expected threshold error, got: %s", errOut.String())
 	}
 }
 func TestRun_PassesWhenAllMeetThreshold(t *testing.T) {
 	t.Parallel()
 	tmp := t.TempDir()
 	policyPath := filepath.Join(tmp, "policy.json")
 	profilePath := filepath.Join(tmp, "coverage.out")
 	policy := `{
  "minimum_statement_coverage": 80,
  "critical_packages": []
 }`
 	if err := os.WriteFile(policyPath, []byte(policy), 0600); err != nil {
 		t.Fatalf("write policy: %v", err)
 	}
 	profile := "mode: set\n" +
 		"git.hrafn.xyz/aether/cue/service/llm/validator.go:1.1,2.1 10 1\n"
 	if err := os.WriteFile(profilePath, []byte(profile), 0600); err != nil {
 		t.Fatalf("write profile: %v", err)
 	}
 	var out bytes.Buffer
 	var errOut bytes.Buffer
 	exit := run(
 		[]string{"--profile", profilePath, "--policy", policyPath, "--src-root", "."},
 		&out,
 		&errOut,
 		func(_ string) ([]string, error) {
 			return []string{"git.hrafn.xyz/aether/cue/service/llm"}, nil
 		},
 	)
 	if exit != 0 {
 		t.Fatalf("expected exit 0, got %d\nstdout: %s\nstderr: %s", exit, out.String(), errOut.String())
 	}
 	if !strings.Contains(out.String(), "all in-scope packages meet threshold") {
 		t.Fatalf("expected success summary, got: %s", out.String())
 	}
 }
--- a/coverage-gate/parse.go
+++ b/coverage-gate/parse.go
@@ -0,0 +1,235 @@
 package main
 import (
 	"bufio"
 	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
 )
 // Policy describes coverage threshold configuration.
 type Policy struct {
 	MinimumStatementCoverage float64         `json:"minimum_statement_coverage"`
 	CriticalPackages         []PackagePolicy `json:"critical_packages"`
 }
 // PackagePolicy overrides defaults for a specific package.
 type PackagePolicy struct {
 	Package                  string   `json:"package"`
 	MinimumStatementCoverage float64  `json:"minimum_statement_coverage"`
 	Include                  bool     `json:"include"`
 	Exclusions               []string `json:"exclusions"`
 }
 // Coverage aggregates covered and total statements for a package.
 type Coverage struct {
 	Covered int64
 	Total   int64
 }
 // PackageResult is the policy-evaluated coverage result for one package.
 type PackageResult struct {
 	Package   string
 	Covered   int64
 	Total     int64
 	Percent   float64
 	Threshold float64
 	Pass      bool
 }
 // LoadPolicy reads policy JSON from disk.
 func LoadPolicy(path string) (Policy, error) {
 	f, err := openValidatedReadOnlyFile(path, ".json", "policy")
 	if err != nil {
 		return Policy{}, err
 	}
 	defer f.Close()
 	var p Policy
 	if err := json.NewDecoder(f).Decode(&p); err != nil {
 		return Policy{}, fmt.Errorf("decode policy: %w", err)
 	}
 	if p.MinimumStatementCoverage <= 0 {
 		p.MinimumStatementCoverage = 80.0
 	}
 	return p, nil
 }
 // ParseCoverProfile parses a Go coverprofile and aggregates package coverage.
 func ParseCoverProfile(profilePath string, policy Policy) (map[string]Coverage, error) {
 	f, err := openValidatedReadOnlyFile(profilePath, "", "coverage profile")
 	if err != nil {
 		return nil, err
 	}
 	defer f.Close()
 	coverage := make(map[string]Coverage)
 	s := bufio.NewScanner(f)
 	lineNo := 0
 	for s.Scan() {
 		lineNo++
 		line := strings.TrimSpace(s.Text())
 		if lineNo == 1 {
 			if !strings.HasPrefix(line, "mode:") {
 				return nil, fmt.Errorf("invalid coverage profile header")
 			}
 			continue
 		}
 		if line == "" {
 			continue
 		}
 		parts := strings.Fields(line)
 		if len(parts) != 3 {
 			return nil, fmt.Errorf("invalid coverage line %d", lineNo)
 		}
 		fileAndRange := parts[0]
 		numStmts, err := strconv.ParseInt(parts[1], 10, 64)
 		if err != nil {
 			return nil, fmt.Errorf("invalid statements count at line %d: %w", lineNo, err)
 		}
 		execCount, err := strconv.ParseInt(parts[2], 10, 64)
 		if err != nil {
 			return nil, fmt.Errorf("invalid execution count at line %d: %w", lineNo, err)
 		}
 		idx := strings.Index(fileAndRange, ":")
 		if idx < 0 {
 			return nil, fmt.Errorf("invalid file segment at line %d", lineNo)
 		}
 		filePath := fileAndRange[:idx]
 		pkg := filepath.ToSlash(filepath.Dir(filePath))
 		if isExcludedFile(pkg, filePath, policy) {
 			continue
 		}
 		agg := coverage[pkg]
 		agg.Total += numStmts
 		if execCount > 0 {
 			agg.Covered += numStmts
 		}
 		coverage[pkg] = agg
 	}
 	if err := s.Err(); err != nil {
 		return nil, fmt.Errorf("scan coverage profile: %w", err)
 	}
 	return coverage, nil
 }
 func openValidatedReadOnlyFile(path string, requiredExt string, label string) (*os.File, error) {
 	cleaned := filepath.Clean(strings.TrimSpace(path))
 	if cleaned == "" || cleaned == "." {
 		return nil, fmt.Errorf("invalid %s path", label)
 	}
 	if requiredExt != "" {
 		ext := strings.ToLower(filepath.Ext(cleaned))
 		if ext != strings.ToLower(requiredExt) {
 			return nil, fmt.Errorf("invalid %s file extension: got %q, want %q", label, ext, requiredExt)
 		}
 	}
 	absPath, err := filepath.Abs(cleaned)
 	if err != nil {
 		return nil, fmt.Errorf("resolve %s path: %w", label, err)
 	}
 	info, err := os.Stat(absPath)
 	if err != nil {
 		return nil, fmt.Errorf("stat %s: %w", label, err)
 	}
 	if info.IsDir() {
 		return nil, fmt.Errorf("%s path must be a file, got directory", label)
 	}
 	// #nosec G304 -- path is explicitly cleaned, normalized, and pre-validated as an existing file.
 	f, err := os.Open(absPath)
 	if err != nil {
 		return nil, fmt.Errorf("open %s: %w", label, err)
 	}
 	return f, nil
 }
 // EvaluateCoverage evaluates package coverage against policy thresholds.
 func EvaluateCoverage(packages []string, byPackage map[string]Coverage, policy Policy) []PackageResult {
 	results := make([]PackageResult, 0, len(packages))
 	for _, pkg := range packages {
 		if !isPackageIncluded(pkg, policy) {
 			continue
 		}
 		agg := byPackage[pkg]
 		percent := 100.0
 		if agg.Total > 0 {
 			percent = float64(agg.Covered) * 100.0 / float64(agg.Total)
 		}
 		threshold := thresholdForPackage(pkg, policy)
 		pass := agg.Total == 0 || percent >= threshold
 		results = append(results, PackageResult{
 			Package:   pkg,
 			Covered:   agg.Covered,
 			Total:     agg.Total,
 			Percent:   percent,
 			Threshold: threshold,
 			Pass:      pass,
 		})
 	}
 	sort.Slice(results, func(i, j int) bool {
 		return results[i].Package < results[j].Package
 	})
 	return results
 }
 func thresholdForPackage(pkg string, policy Policy) float64 {
 	for _, entry := range policy.CriticalPackages {
 		if entry.Package == pkg && entry.MinimumStatementCoverage > 0 {
 			return entry.MinimumStatementCoverage
 		}
 	}
 	if policy.MinimumStatementCoverage > 0 {
 		return policy.MinimumStatementCoverage
 	}
 	return 80.0
 }
 func isPackageIncluded(pkg string, policy Policy) bool {
 	for _, entry := range policy.CriticalPackages {
 		if entry.Package == pkg {
 			return entry.Include
 		}
 	}
 	return true
 }
 func isExcludedFile(pkg string, filePath string, policy Policy) bool {
 	base := filepath.Base(filePath)
 	// Exclude known generated artifacts and thin composition wiring.
 	if strings.HasSuffix(base, "_gen.go") ||
 		base == "generated.go" ||
 		base == "models_gen.go" ||
 		base == "schema.resolvers.go" ||
 		base == "main.go" {
 		return true
 	}
 	for _, entry := range policy.CriticalPackages {
 		if entry.Package != pkg {
 			continue
 		}
 		for _, ex := range entry.Exclusions {
 			if ex == "" {
 				continue
 			}
 			if strings.HasSuffix(filePath, ex) || strings.Contains(filePath, "/"+ex) {
 				return true
 			}
 		}
 	}
 	return false
 }
--- a/coverage-gate/parse_test.go
+++ b/coverage-gate/parse_test.go
@@ -0,0 +1,119 @@
 package main
 import (
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 func TestParseCoverProfile_AppliesExclusions(t *testing.T) {
 	t.Parallel()
 	tmp := t.TempDir()
 	profile := filepath.Join(tmp, "coverage.out")
 	content := "mode: set\n" +
 		"git.hrafn.xyz/aether/cue/api/graph/generated.go:1.1,2.1 2 1\n" +
 		"git.hrafn.xyz/aether/cue/api/graph/resolver.go:1.1,2.1 2 1\n" +
 		"git.hrafn.xyz/aether/cue/service/llm/validator.go:1.1,2.1 2 0\n"
 	if err := os.WriteFile(profile, []byte(content), 0600); err != nil {
 		t.Fatalf("write profile: %v", err)
 	}
 	policy := Policy{
 		MinimumStatementCoverage: 80,
 		CriticalPackages: []PackagePolicy{
 			{Package: "git.hrafn.xyz/aether/cue/api/graph", Include: true, Exclusions: []string{"generated.go"}},
 		},
 	}
 	got, err := ParseCoverProfile(profile, policy)
 	if err != nil {
 		t.Fatalf("ParseCoverProfile() error = %v", err)
 	}
 	api := got["git.hrafn.xyz/aether/cue/api/graph"]
 	if api.Total != 2 || api.Covered != 2 {
 		t.Fatalf("api coverage mismatch: got %+v", api)
 	}
 	llm := got["git.hrafn.xyz/aether/cue/service/llm"]
 	if llm.Total != 2 || llm.Covered != 0 {
 		t.Fatalf("llm coverage mismatch: got %+v", llm)
 	}
 }
 func TestEvaluateCoverage_UsesPolicyThresholds(t *testing.T) {
 	t.Parallel()
 	pkgs := []string{
 		"git.hrafn.xyz/aether/cue/service/llm",
 		"git.hrafn.xyz/aether/cue/service/orchestrator",
 	}
 	byPkg := map[string]Coverage{
 		"git.hrafn.xyz/aether/cue/service/llm":          {Covered: 8, Total: 10},
 		"git.hrafn.xyz/aether/cue/service/orchestrator": {Covered: 3, Total: 10},
 	}
 	policy := Policy{
 		MinimumStatementCoverage: 80,
 		CriticalPackages: []PackagePolicy{
 			{Package: "git.hrafn.xyz/aether/cue/service/orchestrator", MinimumStatementCoverage: 30, Include: true},
 		},
 	}
 	results := EvaluateCoverage(pkgs, byPkg, policy)
 	if len(results) != 2 {
 		t.Fatalf("expected 2 results, got %d", len(results))
 	}
 	if !results[0].Pass {
 		t.Fatalf("expected llm to pass at default threshold: %+v", results[0])
 	}
 	if !results[1].Pass {
 		t.Fatalf("expected orchestrator to pass at overridden threshold: %+v", results[1])
 	}
 }
 func TestEvaluateCoverage_NoStatementsPasses(t *testing.T) {
 	t.Parallel()
 	pkg := "git.hrafn.xyz/aether/cue/repository/vector"
 	results := EvaluateCoverage(
 		[]string{pkg},
 		map[string]Coverage{pkg: {Covered: 0, Total: 0}},
 		Policy{MinimumStatementCoverage: 80},
 	)
 	if len(results) != 1 {
 		t.Fatalf("expected 1 result, got %d", len(results))
 	}
 	if !results[0].Pass {
 		t.Fatalf("expected pass for no-statement package, got %+v", results[0])
 	}
 }
 func TestLoadPolicy_RejectsNonJSONPath(t *testing.T) {
 	t.Parallel()
 	tmp := t.TempDir()
 	policyPath := filepath.Join(tmp, "policy.yaml")
 	if err := os.WriteFile(policyPath, []byte("minimum_statement_coverage: 80\n"), 0600); err != nil {
 		t.Fatalf("write policy file: %v", err)
 	}
 	_, err := LoadPolicy(policyPath)
 	if err == nil {
 		t.Fatal("expected LoadPolicy to fail for non-json extension")
 	}
 	if !strings.Contains(err.Error(), "invalid policy file extension") {
 		t.Fatalf("expected extension error, got: %v", err)
 	}
 }
 func TestParseCoverProfile_RejectsDirectoryPath(t *testing.T) {
 	t.Parallel()
 	_, err := ParseCoverProfile(t.TempDir(), Policy{MinimumStatementCoverage: 80})
 	if err == nil {
 		t.Fatal("expected ParseCoverProfile to fail for directory path")
 	}
 	if !strings.Contains(err.Error(), "coverage profile path must be a file") {
 		t.Fatalf("expected directory path error, got: %v", err)
 	}
 }
--- a/prepare/action.yml
+++ b/prepare/action.yml
@@ -42,6 +42,11 @@ inputs:
      custom version-file.
    required: false
    default: 'CHANGELOG.md release-version'
  token:
    description: >
      Personal access token used to authenticate commit, push, and tag
      operations. Required to ensure downstream workflows trigger on tag push.
    required: true
 outputs:
  version:
@@ -114,7 +119,7 @@ runs:
    - name: Commit and push release
      shell: bash
      env:
-        TOKEN: ${{ github.token }}
+        TOKEN: ${{ inputs.token }}
        GIT_USER_NAME: ${{ inputs.git-user-name }}
        GIT_USER_EMAIL: ${{ inputs.git-user-email }}
        GIT_ADD_FILES: ${{ inputs.git-add-files }}
@@ -124,6 +129,11 @@ runs:
      run: |
        set -euo pipefail
        if [[ -z "${TOKEN:-}" ]]; then
          echo "A release PAT is required. Provide inputs.token (for example secrets.RELEASE_PAT)." >&2
          exit 1
        fi
        case "$GITHUB_SERVER_URL" in
          https://*)
            authed_remote="https://oauth2:${TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git"
--- a/publish/action.yml
+++ b/publish/action.yml
@@ -7,10 +7,9 @@ description: >
 inputs:
  token:
    description: >
-      Token used to authenticate release API calls. Defaults to the
+      Personal access token used to authenticate release API calls.
-      workflow token.
+      Required to support release updates across workflow boundaries.
-    required: false
+    required: true
    default: ''
  version:
    description: >
      Semantic version to publish (with or without leading v). When omitted,
@@ -91,41 +90,66 @@ runs:
      id: create-release
      shell: bash
      env:
-        TOKEN: ${{ inputs.token != '' && inputs.token || github.token }}
+        TOKEN: ${{ inputs.token }}
        TAG_NAME: ${{ steps.resolve-version.outputs.tag }}
        RELEASE_NOTES_FILE: ${{ steps.write-notes.outputs.notes_file }}
        GITHUB_API_URL: ${{ github.api_url }}
        GITHUB_SERVER_URL: ${{ github.server_url }}
        GITHUB_SHA: ${{ github.sha }}
        GITHUB_REPOSITORY: ${{ github.repository }}
      run: |
        set -euo pipefail
        parse_release_id() {
          local json_file="$1"
          if command -v python3 >/dev/null 2>&1; then
            python3 -c 'import json, sys; payload = json.load(open(sys.argv[1], encoding="utf-8")); value = payload.get("id"); print(value if isinstance(value, int) else "")' "$json_file"
            return
          fi
          # Fallback for environments without python3.
          sed -n 's/.*"id"[[:space:]]*:[[:space:]]*\([0-9][0-9]*\).*/\1/p' "$json_file" | head -n 1
        }
        raw_token="$(printf '%s' "${TOKEN:-}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
        if [[ "$raw_token" =~ ^%\!t\(string=(.*)\)$ ]]; then
          raw_token="${BASH_REMATCH[1]}"
        fi
        api_token="$(printf '%s' "$raw_token" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
        if [[ -z "$api_token" ]]; then
          echo "inputs.token is required (set to secrets.RELEASE_PAT)." >&2
          exit 1
        fi
        release_notes="$(cat "$RELEASE_NOTES_FILE")"
        escaped_release_notes="$(printf '%s' "$release_notes" | sed 's/\\/\\\\/g; s/"/\\"/g; :a;N;$!ba;s/\n/\\n/g')"
        release_api="${GITHUB_API_URL:-${GITHUB_SERVER_URL%/}/api/v1}/repos/${GITHUB_REPOSITORY}/releases"
        release_by_tag_api="${release_api}/tags/${TAG_NAME}"
        status_code="$(curl -sS -o release-existing.json -w '%{http_code}' \
-          -H "Authorization: token ${TOKEN}" \
+          -H "Authorization: token ${api_token}" \
          -H "Content-Type: application/json" \
          "${release_by_tag_api}")"
        if [[ "$status_code" == "200" ]]; then
-          existing_release_id="$(sed -n 's/.*"id"[[:space:]]*:[[:space:]]*\([0-9][0-9]*\).*/\1/p' release-existing.json | head -n 1)"
+          existing_release_id="$(parse_release_id release-existing.json)"
          if [[ -z "$existing_release_id" ]]; then
            echo "Failed to parse existing release id for ${TAG_NAME}" >&2
            cat release-existing.json >&2
            exit 1
          fi
-          curl --fail-with-body \
+          if ! curl --fail-with-body \
            -X PATCH \
-            -H "Authorization: token ${TOKEN}" \
+            -H "Authorization: token ${api_token}" \
            -H "Content-Type: application/json" \
            "${release_api}/${existing_release_id}" \
-            --data "{\"tag_name\":\"${TAG_NAME}\",\"target\":\"${GITHUB_SHA}\",\"name\":\"${TAG_NAME}\",\"body\":\"${escaped_release_notes}\",\"draft\":false,\"prerelease\":false}" \
+            --data "{\"tag_name\":\"${TAG_NAME}\",\"name\":\"${TAG_NAME}\",\"body\":\"${escaped_release_notes}\",\"draft\":false,\"prerelease\":false}" \
-            --output release.json
+            --output release.json; then
            cat release.json >&2 || true
            exit 1
          fi
          echo "id=$existing_release_id" >> "$GITHUB_OUTPUT"
        elif [[ "$status_code" != "404" ]]; then
@@ -133,15 +157,18 @@ runs:
          cat release-existing.json >&2
          exit 1
        else
-          curl --fail-with-body \
+          if ! curl --fail-with-body \
            -X POST \
-            -H "Authorization: token ${TOKEN}" \
+            -H "Authorization: token ${api_token}" \
            -H "Content-Type: application/json" \
            "${release_api}" \
-            --data "{\"tag_name\":\"${TAG_NAME}\",\"target\":\"${GITHUB_SHA}\",\"name\":\"${TAG_NAME}\",\"body\":\"${escaped_release_notes}\",\"draft\":false,\"prerelease\":false}" \
+            --data "{\"tag_name\":\"${TAG_NAME}\",\"name\":\"${TAG_NAME}\",\"body\":\"${escaped_release_notes}\",\"draft\":false,\"prerelease\":false}" \
-            --output release.json
+            --output release.json; then
            cat release.json >&2 || true
            exit 1
          fi
-          release_id="$(sed -n 's/.*"id"[[:space:]]*:[[:space:]]*\([0-9][0-9]*\).*/\1/p' release.json | head -n 1)"
+          release_id="$(parse_release_id release.json)"
          if [[ -z "$release_id" ]]; then
            echo "Failed to parse release id from API response" >&2
            cat release.json >&2
--- a/2
+++ b/2
@@ -1 +1 @@
-1.0.2
+1.2.0
Author	SHA1	Message	Date
gitea-actions[bot]	45bb09af27	release: prepare v1.2.0	2026-03-21 23:15:26 +00:00
Micheal Wilkinson	995e397bff	docs: update upx fallback note All checks were successful Push Validation / coverage-badge (push) Successful in 1m24s Details Push Validation / recommend-release (push) Successful in 28s Details	2026-03-21 23:12:30 +00:00
Micheal Wilkinson	8bf7184479	chore(workflows): install upx via ghaction-upx	2026-03-21 23:12:30 +00:00
Micheal Wilkinson	41918cd5de	docs: note containerized upx fallback All checks were successful Push Validation / coverage-badge (push) Successful in 1m23s Details Push Validation / recommend-release (push) Successful in 25s Details	2026-03-21 23:02:35 +00:00
Micheal Wilkinson	0cec30c9bb	chore(workflows): add container upx fallback	2026-03-21 23:02:29 +00:00
Micheal Wilkinson	24dd65da67	docs: log upx fallback in release workflows All checks were successful Push Validation / coverage-badge (push) Successful in 1m18s Details Push Validation / recommend-release (push) Successful in 25s Details	2026-03-21 23:00:08 +00:00
Micheal Wilkinson	1ab56b0536	chore(workflows): allow release builds without upx	2026-03-21 23:00:05 +00:00
Micheal Wilkinson	6919061240	docs: log coverage-gate security hardening Some checks failed Push Validation / recommend-release (push) Has been cancelled Details Push Validation / coverage-badge (push) Has been cancelled Details	2026-03-21 22:47:04 +00:00
Micheal Wilkinson	7b739e04c8	chore(go): harden coverage-gate file input handling	2026-03-21 22:47:02 +00:00
Micheal Wilkinson	98ea91f2df	docs: log coverage-gate extraction to Unreleased Some checks failed Push Validation / coverage-badge (push) Failing after 32s Details Push Validation / recommend-release (push) Has been skipped Details	2026-03-21 22:39:21 +00:00
Micheal Wilkinson	532f6a98d8	feat: extract coverage-gate action from Cue for reuse across projects Some checks failed Push Validation / coverage-badge (push) Failing after 44s Details Push Validation / recommend-release (push) Has been skipped Details - Move coveragegate tool from cue/tools to vociferate/coverage-gate - Create composite action with JSON metrics output for CI - Update tool to export passes/total_coverage/packages_checked/packages_failed - Support per-package threshold policy via JSON configuration - Change module path to git.hrafn.xyz/aether/vociferate/coverage-gate	2026-03-21 22:34:01 +00:00
Micheal Wilkinson	a3e2b4e44e	refactor(release): rename workflows and align update-release path All checks were successful Push Validation / coverage-badge (push) Successful in 1m30s Details Push Validation / recommend-release (push) Successful in 23s Details Rename the reusable workflows to release.yml and update-release.yml, add UPX compression for release binaries, and sync the standalone update-release workflow with the active release pipeline fixes. Update README, AGENTS, compliance notes, and changelog references to match the new workflow names and usage patterns.	2026-03-21 20:26:13 +00:00
gitea-actions[bot]	f82dace4b2	release: prepare v1.1.0	2026-03-21 20:16:35 +00:00
Micheal Wilkinson	81dced6ada	fix(publish): avoid heredoc parsing in composite json helper All checks were successful Push Validation / coverage-badge (push) Successful in 1m53s Details Push Validation / recommend-release (push) Successful in 28s Details Replace the embedded python heredoc with python3 -c so the composite action remains valid YAML and shell across teacup parsing.	2026-03-21 20:14:49 +00:00
Micheal Wilkinson	62693935d0	fix(release): parse release id robustly and validate upload endpoint All checks were successful Push Validation / coverage-badge (push) Successful in 1m36s Details Push Validation / recommend-release (push) Successful in 47s Details Use JSON parsing for release id extraction in publish action instead of regex matching, preventing wrong id selection from nested fields. Add a pre-upload release endpoint check to fail early with explicit release URL diagnostics when the resolved id/path is invalid.	2026-03-21 20:07:45 +00:00
Micheal Wilkinson	c0b5ec385c	fix(release): normalize wrapped release-id before asset upload Some checks failed Push Validation / recommend-release (push) Has been cancelled Details Push Validation / coverage-badge (push) Has been cancelled Details Teacup can wrap workflow outputs as %touch docker-compose.yml(string=...), which produced an invalid releases/{id}/assets URL and a 404 in Upload release binaries. Unwrap and validate release-id before building the API path.	2026-03-21 20:03:00 +00:00
Micheal Wilkinson	84f6fbcfc8	fix(release): unwrap teacup token inputs and correct failure summary Some checks failed Push Validation / recommend-release (push) Has been cancelled Details Push Validation / coverage-badge (push) Has been cancelled Details Normalize %touch docker-compose.yml(string=...) wrapped token values in publish composite before API calls. This prevents malformed Authorization headers under teacup. Also only print 'Release Published' summary when the publish step succeeds, and print a failure summary otherwise.	2026-03-21 19:51:26 +00:00
Micheal Wilkinson	4a2d234ba3	fix(publish): stop sending target field in release payload Some checks failed Push Validation / recommend-release (push) Has been cancelled Details Push Validation / coverage-badge (push) Has been cancelled Details Prepare already creates and pushes the release tag, so publish should not retarget it. Sending target can trigger 403 on Gitea when tag retargeting is restricted. Build PATCH/POST payloads from tag_name + notes only.	2026-03-21 19:46:53 +00:00
Micheal Wilkinson	4841b04076	fix(publish): use tag's actual commit SHA for release target Some checks failed Push Validation / recommend-release (push) Has been cancelled Details Push Validation / coverage-badge (push) Has been cancelled Details GITHUB_SHA (github.sha) reflects the workflow trigger commit, which is the main HEAD before the prepare job ran. The tag itself points to the release commit created by prepare — a different SHA. Gitea rejects PATCH and POST with 403 when target_commitish doesn't match the tag's commit. Use git rev-list -n 1 TAG to resolve the exact SHA the tag points to, ensuring the target field is always correct regardless of when or how the release workflow is called.	2026-03-21 19:39:17 +00:00
Micheal Wilkinson	993768ae9b	refactor(release): inline release and validate jobs into prepare-release All checks were successful Push Validation / coverage-badge (push) Successful in 1m24s Details Push Validation / recommend-release (push) Successful in 42s Details Replaces the workflow_call to do-release with directly inlined release and validate jobs. All steps now appear flat in the Actions UI with full individual step visibility instead of being collapsed under a setup job. Tag resolution in the release job is simplified: the tag always comes from needs.prepare.outputs.tag, removing the detect-tag guessing needed for standalone dispatch. do-release.yml is unchanged and remains available for manual dispatch.	2026-03-21 19:30:53 +00:00
Micheal Wilkinson	624b9d154c	fix(release): re-enable workflow_call publish path in prepare-release All checks were successful Push Validation / coverage-badge (push) Successful in 1m18s Details Push Validation / recommend-release (push) Successful in 23s Details Tag push events never fire on this Gitea 1.25.x instance (confirmed across 159 workflow run history). The workflow_call path is reliable and has worked consistently. Remove the temporary if-false guard.	2026-03-21 19:23:31 +00:00
Micheal Wilkinson	53a097784e	chore(workflows): use go-version-file for setup-go All checks were successful Push Validation / coverage-badge (push) Successful in 1m14s Details Push Validation / recommend-release (push) Successful in 23s Details	2026-03-21 16:26:16 +00:00
Micheal Wilkinson	511110f466	chore(release): temporarily disable inline do-release call All checks were successful Push Validation / coverage-badge (push) Successful in 1m10s Details Push Validation / recommend-release (push) Successful in 26s Details Disable the publish job in prepare-release to validate that tag push triggers do-release automatically via workflow trigger path.	2026-03-21 16:19:22 +00:00
Micheal Wilkinson	d5170b6874	fix(release): require RELEASE_PAT for tag and release updates All checks were successful Push Validation / coverage-badge (push) Successful in 1m11s Details Push Validation / recommend-release (push) Successful in 24s Details Stop using GITHUB_TOKEN/GITEA_TOKEN fallbacks in prepare/do-release/publish mutation paths. Require explicit PAT wiring via secrets.RELEASE_PAT for commit/push/tag and release update operations so downstream workflows trigger reliably.	2026-03-21 16:17:17 +00:00
		`@@ -0,0 +1,3 @@`
							`module git.hrafn.xyz/aether/vociferate/coverage-gate`

							`go 1.26.1`