Repository navigation
Run releases only on a confirmed dispatch; install from source - #39
Merged
Merged
Conversation
Go releases are git only until the owner decides otherwise for this project. A tag push no longer starts GoReleaser; a release is dispatched on a v[0-9]* tag with -f confirm=release-go, and the first step refuses anything else before a single artifact is built. TestReleaseRunsOnlyOnAConfirmedDispatch fails if release.yml regains an automatic trigger or loses the confirmation; it was seen failing with the old tag-push trigger restored. docs/release.md describes the new steps.
Binary releases are on hold, so the README and installation guide no longer offer the install scripts, Homebrew, Scoop, Linux packages, the container image, release downloads or go install. They give a clone, make build and probaci install, how to pin a tag and update, and note that no binary release has been published yet. The release tooling and install scripts stay in the tree.
gosec@latest resolved to v2.30.0, whose go.mod requires go >= 1.26. The job runs Go 1.25 with GOTOOLCHAIN=local, so go install refused it and the job failed before scanning anything. v2.29.0 is the newest release that accepts 1.25, matching the go-version every other job and go.mod use. It scans the module clean with the existing excludes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Go releases are git only until the owner decides otherwise for this project. This makes the release workflow unable to start by itself and makes the docs offer building from source only.
release.ymltriggers onworkflow_dispatchonly, with a requiredconfirminput. Its first step, before checkout, refuses unlessconfirmisrelease-goand the run was dispatched on av[0-9]*tag. The input is passed throughenv, not interpolated into the script. Every other step (GoReleaser, cosign, SBOM, ghcr login, attestation, CHANGELOG notes) is unchanged.TestReleaseRunsOnlyOnAConfirmedDispatch(release_workflow_test.go, root package) fails ifrelease.ymlhas apush,schedule,pull_requestorreleasetrigger, or is missingworkflow_dispatch, theconfirminput, therelease-gocheck or the tag check.docs/release.md: pushing a tag publishes nothing. A release isgh workflow run release.yml --repo simtabi/probaci --ref vX.Y.Z -f confirm=release-go, on a tag already on GitHub, and only for a version the owner approved.docs/installation.mdnow cover building from source only: clone,make build,probaci install, pinning a tag and updating. Homebrew, Scoop, the install scripts, release downloads, the container image andgo installare no longer offered. No binary release has ever been published (the repo has no tags), so there are no frozen channels to describe.scripts/install.shandscripts/install.ps1stay in the tree.[Unreleased]entries for both changes.ci.yml: thegosecjob installedgosec@latest, which now resolves to v2.30.0 and requires go >= 1.26, so on the job's Go 1.25 (GOTOOLCHAIN=local) it failed at install and scanned nothing. Pinned to v2.29.0, the newest release that accepts Go 1.25, with a comment saying why. Excludes unchanged; no code changes were needed.codeql.yml,keepalive.ymlandscorecard.ymlare untouched.Verification
gofmt -l .printed nothing.go vet .passed, andgo test -run 'TestReleaseRunsOnlyOnAConfirmedDispatch|TestDocLookup' .passed.release.ymlfrommain(thepush: tags: ["v*"]trigger), and the test failed with "release.yml has an automatic trigger" plus all four missing-marker errors. I put the new file back,cmpshowed it identical, and the test passed again.release.ymlparses as YAML. actionlint is not installed locally.go vet ./.../go test ./...across the whole module locally, because the sandbox cannot download modules. CI runs it.-exclude=G104,G204,G301,G302,G304,G306 ./...): 45 files, 0 issues, 4 existing#nosec.go vet ./...andgo test ./...passed under the same toolchain, andgofmt -l .printed nothing.