[imanimanyara]

Summary

Moves vigil's release onto simtabi/.github's shared Go release workflow, per the 2026-11-13 standard: binaries ship on the GitHub release only, and a release builds on a pushed version tag or on request.

git push origin vX.Y.Z                                            # builds and publishes vX.Y.Z
gh workflow run release.yml --repo simtabi/vigil -f tag=vX.Y.Z    # the same, for a tag already pushed

uses: pins simtabi/.github/.github/workflows/go-release.yml@941f7b7ecce5dc8af6daedfc7496dd4367c70877, the merge commit of simtabi/.github#28, which added the runs-on and environment inputs vigil needs.

• release.yml is a thin caller with runs-on: macos-latest and environment: release, as before. Its triggers are push: tags (v[0-9]+.[0-9]+.[0-9]+, v[0-9]+.[0-9]+.[0-9]+-*) and workflow_dispatch with a required tag, with concurrency per tag, never cancelled.
• Each old step maps to the shared workflow: the tag check, checkout, go-version-file: src/go.mod, syft, GOPRIVATE/GONOSUMDB, the src/vX.Y.Z alias, GoReleaser on src/.goreleaser.yaml, and attestation over .cache/goreleaser/checksums.txt. There are no extra assets and no post-release step. Past release runs took about 7 minutes, so the shared 40-minute timeout (the old one was 60) leaves room.
• Release notes. The old workflow set the body twice: --release-notes from src/scripts/extract-changelog.sh, then gh release edit --notes-file. The shared workflow passes --release-notes, then reads the published body back and fails the run if it is shorter than the section. For v0.1.0 (the only version tag on GitHub) the body text is the same section, with three differences: a leading blank line, a **Full changelog:** link appended, and, because 0.1.0 is the bottom section, the file's link-reference definitions (GitHub does not render those). One behaviour difference: if GoReleaser ever dropped the notes, the old step would have repaired the body. The shared workflow fails red instead, leaving the release with an empty body to fix by hand.
• The Release workflow stays disabled in Actions (disabled_manually since 2026-11-08), so after this merges neither a tag push nor a request runs anything until the owner runs gh workflow enable release.yml --repo simtabi/vigil. I did not change that setting. docs/release.md now says so, and corrects the stale reason: measured today, v0.1.0 is the only version tag on GitHub, and its release.yml is dispatch-only behind confirm=release-go.
• Docs: README and docs/installation.md offer the release download, then a build from source. They also say GitHub lists no vigil release yet: GET repos/simtabi/vigil/releases returned 0 today, although the old docs described 0.1.0 to 0.7.0 as published. docs/updating.md drops the "on hold" banner.

Removed

• src/.goreleaser.yaml: the homebrew_casks, scoops and winget blocks. simtabi/homebrew-tap and simtabi/scoop-bucket hold no vigil entry; the same probe found Casks/osaat.rb, so it can see one.
• release.yml: the TAP_GITHUB_TOKEN, HOMEBREW_TAP_DEPLOY_KEY and SCOOP_BUCKET_DEPLOY_KEY env, the SKIP_WINDOWS_PKGS / SKIP_SCOOP switches, the confirm=release-go refusal step, and the gh release edit notes step. The repository secrets and variables themselves are untouched.
• Tests: TestReleaseRunsOnlyOnAConfirmedDispatch (and its automaticTrigger regexp) became TestReleaseRunsOnAVersionTagOrOnRequest. TestReleaseMirrorsTheSrcTag, which read the inline alias script, became TestReleaseInputsMatchTheRepository (alias on, this repo's config, go.mod and changelog, runs-on: macos-latest, environment: release); its GoReleaser dist/dir/ldflags checks are kept. TestReleasesCarryTheirChangelogSection keeps its changelog.disable check and now requires the shared call instead of gh release edit. New: TestGoReleaserPublishesNowhereElse asserts the removed blocks, and every other banned block, are absent.

Verification

• go -C src test -count=1 ./... passes, except internal/netcheck, whose httptest server cannot bind a port in the local sandbox (CI runs it). go -C src vet ./... and gofmt -l src are clean; golangci-lint run ./... reports 0 issues; goreleaser check (2.20.1) validates. actionlint 1.7.12 is clean on release.yml; its one warning is an existing SC2046 in the unchanged ci.yml.
• Proved red with go test -count=1, then restored: branches: [main], a schedule trigger, uses: pointed elsewhere, runs-on: ubuntu-latest, environment removed, module-alias-prefix: '', changelog: NOTES.md, and a brews: block. Each failed its guard.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.