[Sukitly]

Summary

• add a GitHub Releases workflow for Linux x86_64, Linux aarch64, macOS Intel, and macOS aarch64
• run the native host suite, build the complete distribution, verify checksums, and smoke-test all three executables on every release target
• assemble exactly four native archives, a version-pinned installer, and SHA256SUMS
• generate GitHub artifact attestations only for trusted tag builds
• require release-environment approval before creating a draft release; publication remains a manual immutable step
• add a transactional macOS/Linux installer that embeds all archive checksums and rejects unexpected paths, links, unsupported platforms, relative prefixes, and partial replacement
• centralize the release member layout so source installation, archive validation, and generated installation share one contract
• document installation, attestation verification, release preparation, draft review, publication, and failure handling

Release assets

An exact vMAJOR.MINOR.PATCH tag produces:

• gitveil-v<version>-darwin-aarch64.tar.gz
• gitveil-v<version>-darwin-x86_64.tar.gz
• gitveil-v<version>-linux-aarch64.tar.gz
• gitveil-v<version>-linux-x86_64.tar.gz
• gitveil-installer.sh
• SHA256SUMS

The tag must match Cargo.toml and point to origin/main. The workflow refuses to replace a published release.

Installer guarantees

• release-specific URL and embedded SHA-256 for every native archive
• downloads only the current OS/architecture artifact
• exact member allowlist before extraction
• files and directories only; links and special members are rejected
• complete executable validation before publication into the prefix
• transactional replacement with rollback after injected commit failure
• user-local $HOME/.local default and explicit absolute --prefix
• no sudo, shell-profile modification, system SOPS/age mutation, or identity generation

Repository controls

Configured alongside this pull request:

• immutable GitHub Releases enabled
• active Protect release tags ruleset prevents update and deletion of refs/tags/v*
• release environment accepts only v* tags and requires approval by Sukitly

Local validation

• Red: 6 installer contract tests failed because the assembler entry point did not exist
• release installer contract: 10 passed
• package contract: 7 passed
• Nextest partition: Core 105, Host 164, overlap 0, union 269
• Rust formatting
• functional-core dependency check
• public documentation link check
• Python and workflow YAML syntax
• all Actions pinned to full commit SHAs
• script role, patch whitespace, public-content, private-reference, and residue scans

The pull request Release workflow is the authoritative four-target archive validation. Attestation and draft-publication jobs are deliberately skipped for pull request events.