main merge

.github/workflows/build.yaml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [ main, master, develop ]
   pull_request:
-    branches: [ main, master, develop ]
   workflow_dispatch:
 
 concurrency:

.github/workflows/pr-checks.yaml

@@ -2,7 +2,6 @@ name: PR Checks
 
 on:
   pull_request:
-    branches: [ main, master, develop ]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

.github/workflows/release.yaml

@@ -11,26 +11,49 @@ permissions:
 
 jobs:
   goreleaser:
-    runs-on: ubuntu-latest
+    runs-on: macos-latest
     steps:
-      -
-        name: Checkout
+      - name: Checkout
         uses: actions/checkout@v4
         with:
           submodules: recursive
-      -
-        name: Set up Go
+
+      - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
-      -
-        name: Run GoReleaser
+
+      - name: Import Apple Developer certificate
+        env:
+          APPLE_CERT_DATA: ${{ secrets.APPLE_CERT_DATA }}
+          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
+        run: |
+          KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain-db"
+          CERT_PATH="$RUNNER_TEMP/certificate.p12"
+
+          security create-keychain -p "" "$KEYCHAIN_PATH"
+          security default-keychain -s "$KEYCHAIN_PATH"
+          security unlock-keychain -p "" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 3600 "$KEYCHAIN_PATH"
+
+          printf '%s' "$APPLE_CERT_DATA" | base64 --decode > "$CERT_PATH"
+          security import "$CERT_PATH" \
+            -k "$KEYCHAIN_PATH" \
+            -P "$APPLE_CERT_PASSWORD" \
+            -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple: -s -k "" "$KEYCHAIN_PATH"
+          security find-identity -v -p codesigning "$KEYCHAIN_PATH"
+
+      - name: Release with GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:
-          # either 'goreleaser' (default) or 'goreleaser-pro'
           distribution: goreleaser
-          # 'latest', 'nightly', or a semver
-          version: 'latest'
+          version: latest
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APPLE_CERT_DATA: ${{ secrets.APPLE_CERT_DATA }}
+          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
+          APPLE_NOTARY_PASSWORD: ${{ secrets.APPLE_NOTARY_PASSWORD }}
+          APPLE_NOTARY_USER: ${{ secrets.APPLE_NOTARY_USER }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

.github/workflows/syfon-backend-e2e.yaml

@@ -2,7 +2,6 @@ name: Syfon Backend E2E
 
 on:
   pull_request:
-    branches: [ main, master, develop ]
   workflow_dispatch:
 
 concurrency:
@@ -34,43 +33,39 @@ jobs:
         with:
           go-version-file: git-drs/go.mod
 
-      - name: Resolve Syfon ref from go.mod
+      - name: Resolve Syfon ref from pinned module version
         id: syfon-ref
         working-directory: git-drs
         shell: bash
         run: |
-          version="$(go list -m -f '{{ .Version }}' github.com/calypr/syfon 2>/dev/null || true)"
+          version="$(go list -m -f '{{ .Version }}' github.com/calypr/syfon)"
           if [[ -z "$version" || "$version" == "<nil>" ]]; then
-            version="$(go list -m -f '{{ .Version }}' github.com/calypr/syfon/client)"
+            echo "error: could not resolve pinned syfon version" >&2
+            exit 1
           fi
+
           ref="$version"
-          if [[ "$version" =~ -([0-9a-f]{12,})$ ]]; then
-            short_ref="${BASH_REMATCH[1]}"
-            ref="$(git ls-remote https://github.com/calypr/syfon.git "refs/heads/*" "refs/tags/*" |
-              awk -v short="$short_ref" 'index($1, short) == 1 && ref == "" { ref = $1 } END { print ref }')"
-            if [[ -z "$ref" ]]; then
-              echo "Could not resolve Syfon pseudo-version commit $short_ref to a full Git SHA" >&2
-              exit 1
-            fi
+          if [[ "$version" =~ -([0-9a-f]{12,40})$ ]]; then
+            ref="${BASH_REMATCH[1]}"
           fi
+
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
-          echo "Using Syfon module version $version; checking out calypr/syfon ref $ref"
+          echo "Using Syfon module version $version; checking out local ref $ref"
 
       - name: Check out Syfon
         uses: actions/checkout@v4
         with:
           repository: calypr/syfon
-          ref: ${{ steps.syfon-ref.outputs.ref }}
           path: syfon
-          fetch-depth: 1
+          fetch-depth: 0
 
-      - name: Check out data-client
-        uses: actions/checkout@v4
-        with:
-          repository: calypr/data-client
-          path: data-client
-          fetch-depth: 1
+      - name: Select pinned Syfon commit
+        working-directory: syfon
+        shell: bash
+        run: |
+          git checkout --detach "${{ steps.syfon-ref.outputs.ref }}"
+          git rev-parse --verify HEAD
 
       - name: Install test prerequisites
         working-directory: git-drs

.github/workflows/test.yaml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [ main, master, develop ]
   pull_request:
-    branches: [ main, master, develop ]
   workflow_dispatch:
 
 concurrency:

.goreleaser.yaml

@@ -1,10 +1,61 @@
+version: 2
+
 builds:
-  - binary: git-drs
+  - id: darwin-amd64
+    binary: git-drs
     goos:
       - darwin
+    goarch:
+      - amd64
+    env:
+      - CGO_ENABLED=0
+    hooks:
+      post:
+        - codesign --force --options=runtime -s "{{ .Env.APPLE_TEAM_ID }}" "{{ .Path }}"
+        - >-
+          sh -c 'set -e;
+          ZIP_PATH="$(mktemp -t git-drs-notary-XXXXXX).zip";
+          trap "rm -f \"$ZIP_PATH\"" EXIT;
+          ditto -c -k --keepParent "{{ .Path }}" "$ZIP_PATH";
+          xcrun notarytool submit "$ZIP_PATH"
+          --apple-id "{{ .Env.APPLE_NOTARY_USER }}"
+          --password "{{ .Env.APPLE_NOTARY_PASSWORD }}"
+          --team-id "{{ .Env.APPLE_TEAM_ID }}"
+          --wait'
+  - id: darwin-arm64
+    binary: git-drs
+    goos:
+      - darwin
+    goarch:
+      - arm64
+    env:
+      - CGO_ENABLED=0
+    hooks:
+      post:
+        - codesign --force --options=runtime -s "{{ .Env.APPLE_TEAM_ID }}" "{{ .Path }}"
+        - >-
+          sh -c 'set -e;
+          ZIP_PATH="$(mktemp -t git-drs-notary-XXXXXX).zip";
+          trap "rm -f \"$ZIP_PATH\"" EXIT;
+          ditto -c -k --keepParent "{{ .Path }}" "$ZIP_PATH";
+          xcrun notarytool submit "$ZIP_PATH"
+          --apple-id "{{ .Env.APPLE_NOTARY_USER }}"
+          --password "{{ .Env.APPLE_NOTARY_PASSWORD }}"
+          --team-id "{{ .Env.APPLE_TEAM_ID }}"
+          --wait'
+  - id: linux-amd64
+    binary: git-drs
+    goos:
       - linux
     goarch:
       - amd64
+    env:
+      - CGO_ENABLED=0
+  - id: linux-arm64
+    binary: git-drs
+    goos:
+      - linux
+    goarch:
       - arm64
     env:
       - CGO_ENABLED=0
@@ -18,5 +69,11 @@ env_files:
   github_token: .github_token
 
 archives:
-  - format: tar.gz
-    name_template: "{{.ProjectName}}-{{.Os}}-{{.Arch}}-{{.Version}}"
+  - formats:
+      - tar.gz
+    name_template: "{{.ProjectName}}-{{.Os}}-{{.Arch}}-v{{.Version}}"
+
+    # HACK: Provide a file glob that matches nothing in your directory.
+    # This prevents GoReleaser from reverting to default README/LICENSE fallback files.
+    files:
+      - none*

Makefile

@@ -48,19 +48,29 @@ lint:
 	@echo "Running go vet..."
 	@go vet ./...
 	@echo "Running gofmt..."
-	@test -z "$$(gofmt -s -l . | tee /dev/stderr)" || (echo "Please run: gofmt -s -w ." && exit 1)
+	@files="$$(gofmt -s -l cmd/ internal/ tests/ git-drs.go)"; \
+	if [ -n "$$files" ]; then \
+		printf "%s\n" "$$files"; \
+		echo "Please run: gofmt -s -w cmd/ internal/ tests/ git-drs.go"; \
+		exit 1; \
+	fi
 	@echo "Running goimports..."
-	@test -z "$$(goimports -l . | tee /dev/stderr)" || (echo "Please run: goimports -w ." && exit 1)
+	@files="$$(goimports -l cmd/ internal/ tests/ git-drs.go)"; \
+	if [ -n "$$files" ]; then \
+		printf "%s\n" "$$files"; \
+		echo "Please run: goimports -w cmd/ internal/ tests/ git-drs.go"; \
+		exit 1; \
+	fi
 	@echo "Running misspell..."
-	@misspell -error .
+	@misspell -error cmd/ internal/ tests/ docs/ *.go *.md Makefile
 	@echo "✅ All lint checks passed!"
 
 # Auto-fix formatting issues
 fmt:
 	@echo "Formatting with gofmt..."
-	@gofmt -s -w .
+	@gofmt -s -w cmd/ internal/ tests/ git-drs.go
 	@echo "Formatting with goimports..."
-	@goimports -w .
+	@goimports -w cmd/ internal/ tests/ git-drs.go
 	@echo "✅ Formatting complete!"
 
 # Run all tests
@@ -117,4 +127,4 @@ full: proto install tidy lint test website webdash
 clean:
 	@rm -rf ./bin ./pkg ./test_tmp ./build ./buildtools
 
-.PHONY: proto proto-lint website docker webdash build debug coverage coverage-clients coverage-html-full
+.PHONY: proto proto-lint website docker webdash build debug coverage coverage-clients coverage-html-full test install