feat(release): finish M2 distribution via GoReleaser - #10
Merged
Conversation
Static binaries (linux/darwin/windows x amd64/arm64) + checksums + SBOM, .deb/.rpm/.apk via nfpm (Debian/Ubuntu/Kali, Fedora/RHEL, Alpine), Homebrew cask. Fully automated, grouped release notes from Conventional Commits with a templated install/verify header+footer. go install works today. Add RELEASING.md runbook, make release-check/snapshot, and a goreleaser check step to the local gate; document install paths; check M2 ship boxes. AUR (nock-bin) wired but disabled (signups frozen Jun 2026). Homebrew uses the HOMEBREW_TAP_TOKEN secret + jessn-dev/homebrew-tap; Releases and Linux packages need no setup.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdds a GoReleaser release pipeline with Linux packages, Homebrew cask publishing, release-note templating, validation hooks, and updated release/install documentation. ChangesRelease Pipeline Setup
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
jessn-dev
added
feature
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/install.md`:
- Around line 6-8: The status banner in the install docs overstates what the
release pipeline ships by mentioning AUR even though it is disabled elsewhere in
this change. Update the banner text to keep the release-pipeline summary
accurate, and ensure the wording around the GoReleaser-based publishing only
names the destinations that are actually enabled today.
- Around line 27-38: The install example in the Release binaries section
verifies the archive only after it has already been extracted, which should be
reversed. Update the `docs/install.md` example to run checksum validation with
`checksums.txt` before any `tar xzf` extraction, and keep the guidance aligned
with the release-binary download flow so users validate the
`nock_*_linux_amd64.tar.gz` archive first and extract only after it passes
verification.
- Around line 59-66: The Homebrew install command is using formula syntax for a
package that is actually a cask. Update the documented install command to use
the cask form in both the install guide and RELEASING.md, keeping the
surrounding Homebrew section and the nock package reference unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 25591501-3dc3-446b-a39c-cc44cc22380e
📒 Files selected for processing (8)
.github/workflows/release.yml.goreleaser.yamlMakefileREADME.mdRELEASING.mdROADMAP.mddocs/install.mdscripts/dev-check.sh
- install.md: drop AUR from status banner (it's disabled); verify checksum before
extracting; use 'brew install --cask' (it's a cask, not a formula)
- mirror the --cask fix in RELEASING.md and the goreleaser release-notes footer
- .coderabbit.yaml: profile chill -> assertive (solo, security-sensitive project)
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.coderabbit.yaml:
- Around line 11-14: The contributor documentation is out of sync with the
configured review profile in the repo settings. Update the review-profile
wording in CONTRIBUTING.md so it matches the current assertive profile used in
the configuration, and make sure any references to CHILL are replaced with the
new profile name where the review behavior is described.
In `@docs/install.md`:
- Line 35: The install guide example is Linux-only, so make the checksum
verification snippet in the install docs explicitly labeled as a Linux example.
Update the section around the sha256sum/tar flow to reference the Linux archive
path or add equivalent verification steps for macOS and Windows so the
platform-specific nature is clear and the instructions remain actionable. Use
the existing install section and the checksum verification snippet as the anchor
when editing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 9bb0f98d-c886-4b1f-8f75-c8d98d8839f5
📒 Files selected for processing (4)
.coderabbit.yaml.goreleaser.yamlRELEASING.mddocs/install.md
- install.md: label the checksum example as Linux; add macOS (shasum) and Windows
(CertUtil) verification equivalents
- CONTRIBUTING.md: sync review-profile wording chill -> assertive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Finishes Milestone 2's "Ship" item: a complete, automated release pipeline via
GoReleaser. A version tag now produces cross-platform binaries, native Linux
packages, checksums, an SBOM, auto-generated release notes, and a Homebrew cask —
no manual steps. Targets
develop(git-flow).Channels
.tar.gz/.zip).deb/.rpm/.apk(nfpm)HOMEBREW_TAP_TOKEN(done)go installAURThe binary is a single static
CGO_ENABLED=0build, so it runs on any distroregardless of packaging.
Release notes — automated
The GitHub Release body is generated from Conventional Commits: grouped
Features / Fixes, scope-aware excludes (drops
chore(deps),docs,ci, …),wrapped in a templated header (tagline) and footer (install + checksum-verify +
the show-before-fire safety note).
prerelease: autoflags-rc/-betatags.Zero manual editing per release.
Security / supply chain
checksums.txt) and ship a CycloneDX SBOM.CGO_ENABLED=0 -trimpath, version/commit/date stamped via ldflags.first run isn't blocked by Gatekeeper.
wave), so
nock-bincan't be registered yet. Theaurs:block is commented witha re-enable note — a third-party channel going unavailable must never block a
release.
Tooling
RELEASING.md— the standing release runbook (checked into the repo).make release-check/make release-snapshot;goreleaser checkadded to themake verifylocal gate (living gate, tracks CI).docs/install.mddocuments every install path; README linksRELEASING.md.Validation
goreleaser checkclean;goreleaser release --snapshotbuilds all 6 archives +.deb/.rpm/.apk+ cask; release notes rendered from a throwaway tag.nock versionstamp correct).make verifygreen (cross-build + cross-lint all target OSes, race tests,govulncheck);
actionlintclean onrelease.yml.Out of scope
GitHub Discussions (deliberately deferred to the public v1 launch). Package GPG
signing is a later hardening fast-follow. AUR re-enables when signups reopen.
After merge
Merge
develop -> main, thengit tag v0.1.0-rc1 && git push --tagsto validatethe full pipeline end-to-end before tagging
v0.1.0.Summary by CodeRabbit
make release-checkandmake release-snapshot.RELEASING.mdcovering the end-to-end release process and post-release verification.