release

module

v0.1.18 Latest Latest Go to latest Published: Aug 26, 2026 License: Apache-2.0, MIT

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/meigma/release

Links

Open Source Insights

README ¶

Release workflows

This repository publishes release-cli and reusable GitHub Actions workflows for releasing static Go binaries from one repository. A release can produce GitHub Release assets, a multi-architecture image in GHCR, Homebrew and Scoop update pull requests, and signed DEB, RPM, and APK repositories in Cloudflare R2.

Supported release

The supported application contract is intentionally narrow:

one Go repository, one unscoped tag stream, and one GHCR image;
Linux amd64 and arm64 must publish the same nonempty set of static binary names;
stable, unscoped vMAJOR.MINOR.PATCH tags;
static Darwin, Linux, and Windows binaries for amd64 and arm64;
Linux amd64 and arm64 images at ghcr.io/<owner>/<repository>;
DEB, RPM, and APK packages;
cask-only Homebrew taps; and
root-layout Scoop buckets.

Each consumer pins every reusable workflow and signer identity to one reviewed, full meigma/release commit SHA. The workflows, setup action, and release-cli at that commit form one release unit.

Release flow

Release Please pull request
  -> stable tag and draft GitHub Release
  -> build, sign, and verify release assets
  -> build and verify the OCI image
  -> publish and attest the image
  -> attest assets and publish the GitHub Release
  -> open reviewed Homebrew and Scoop pull requests
  -> optionally request central native-package publication

Publication controls are disabled in the copyable Go example. Rehearse the complete build and inspect its draft and workflow artifacts before enabling destinations.

Documentation

License

Licensed under either the Apache License 2.0 or the MIT License, at your option.

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
release-cli command Package main is the release-cli process entrypoint.	Package main is the release-cli process entrypoint.
internal
adapter/apko Package apko implements image.Composer by invoking the pinned apko binary.	Package apko implements image.Composer by invoking the pinned apko binary.
adapter/apko/mocks Package mocks contains Mockery-generated doubles for image.Composer.	Package mocks contains Mockery-generated doubles for image.Composer.
adapter/cosign Package cosign implements puboci.Signer and pubgh.BlobVerifier by invoking the pinned cosign binary.	Package cosign implements puboci.Signer and pubgh.BlobVerifier by invoking the pinned cosign binary.
adapter/cosign/mocks Package mocks contains Mockery-generated doubles for puboci.Signer and pubgh.BlobVerifier.	Package mocks contains Mockery-generated doubles for puboci.Signer and pubgh.BlobVerifier.
adapter/ghact Package ghact implements pubgh.ArtifactMeta with go-github.	Package ghact implements pubgh.ArtifactMeta with go-github.
adapter/ghact/mocks Package mocks contains Mockery-generated doubles for pubgh.ArtifactMeta.	Package mocks contains Mockery-generated doubles for pubgh.ArtifactMeta.
adapter/ghattest Package ghattest verifies GitHub build-provenance attestations through the gh CLI.	Package ghattest verifies GitHub build-provenance attestations through the gh CLI.
adapter/ghattest/mocks Package mocks provides generated GitHub attestation test doubles.	Package mocks provides generated GitHub attestation test doubles.
adapter/ghbucket Package ghbucket implements Scoop bucket repository reads and writes with the GitHub REST API.	Package ghbucket implements Scoop bucket repository reads and writes with the GitHub REST API.
adapter/ghbucket/mocks Package mocks contains generated test doubles for Scoop bucket repository ports.	Package mocks contains generated test doubles for Scoop bucket repository ports.
adapter/ghrel Package ghrel implements pubgh.ReleaseReader and pubgh.Publisher with go-github.	Package ghrel implements pubgh.ReleaseReader and pubgh.Publisher with go-github.
adapter/ghrel/mocks Package mocks contains Mockery-generated doubles for pubgh.ReleaseReader and pubgh.Publisher.	Package mocks contains Mockery-generated doubles for pubgh.ReleaseReader and pubgh.Publisher.
adapter/ghtap Package ghtap implements Homebrew tap repository reads and writes with the GitHub REST API.	Package ghtap implements Homebrew tap repository reads and writes with the GitHub REST API.
adapter/ghtap/mocks Package mocks contains generated test doubles for Homebrew tap repository ports.	Package mocks contains generated test doubles for Homebrew tap repository ports.
adapter/ghup Package ghup implements pubgh.AssetReplacer by invoking the gh CLI.	Package ghup implements pubgh.AssetReplacer by invoking the gh CLI.
adapter/ghup/mocks Package mocks contains Mockery-generated doubles for pubgh.AssetReplacer.	Package mocks contains Mockery-generated doubles for pubgh.AssetReplacer.
adapter/gitx Package gitx implements pubgh.RefResolver by invoking the git binary.	Package gitx implements pubgh.RefResolver by invoking the git binary.
adapter/gitx/mocks Package mocks contains Mockery-generated doubles for pubgh.RefResolver.	Package mocks contains Mockery-generated doubles for pubgh.RefResolver.
adapter/gpg Package gpg creates deterministic aggregate APT and RPM metadata signatures with a configured GnuPG home, key identity, and owner-only passphrase file.	Package gpg creates deterministic aggregate APT and RPM metadata signatures with a configured GnuPG home, key identity, and owner-only passphrase file.
adapter/gpg/mocks Package mocks provides generated OpenPGP signing test doubles.	Package mocks provides generated OpenPGP signing test doubles.
adapter/melange Package melange implements image.APKBuilder by invoking the pinned Melange binary.	Package melange implements image.APKBuilder by invoking the pinned Melange binary.
adapter/melange/mocks Package mocks contains Mockery-generated doubles for image.APKBuilder.	Package mocks contains Mockery-generated doubles for image.APKBuilder.
adapter/pkginstall Package pkginstall verifies package repositories with native package-manager clients.	Package pkginstall verifies package repositories with native package-manager clients.
adapter/pkginstall/mocks Package mocks provides generated native-installer test doubles.	Package mocks provides generated native-installer test doubles.
adapter/pkgmeta Package pkgmeta reads normalized metadata from native DEB, RPM, and APK package files.	Package pkgmeta reads normalized metadata from native DEB, RPM, and APK package files.
adapter/pkgmeta/mocks Package mocks provides generated package metadata inspection test doubles.	Package mocks provides generated package metadata inspection test doubles.
adapter/pkgverify Package pkgverify verifies producer-native RPM and APK package signatures through fixed, networkless container invocations and producer public keys.	Package pkgverify verifies producer-native RPM and APK package signatures through fixed, networkless container invocations and producer public keys.
adapter/pkgverify/mocks Package mocks provides generated native package verification test doubles.	Package mocks provides generated native package verification test doubles.
adapter/r2 Package r2 stores package repository objects in Cloudflare R2 through its S3 API.	Package r2 stores package repository objects in Cloudflare R2 through its S3 API.
adapter/r2/mocks Package mocks provides generated object-store test doubles.	Package mocks provides generated object-store test doubles.
adapter/reg Package reg implements puboci.StateReader, puboci.ContentPusher, and puboci.TagCommitter with oras-go.	Package reg implements puboci.StateReader, puboci.ContentPusher, and puboci.TagCommitter with oras-go.
adapter/reg/mocks Package mocks contains Mockery-generated doubles for puboci.StateReader.	Package mocks contains Mockery-generated doubles for puboci.StateReader.
adapter/repogen Package repogen regenerates deterministic APT, RPM/DNF, and APK repository metadata with the spike-selected native tools and publishes every SHA-256 and SHA-512 APT by-hash object advertised by the generated Release document.	Package repogen regenerates deterministic APT, RPM/DNF, and APK repository metadata with the spike-selected native tools and publishes every SHA-256 and SHA-512 APT by-hash object advertised by the generated Release document.
adapter/repogen/mocks Package mocks provides generated repository metadata generation test doubles.	Package mocks provides generated repository metadata generation test doubles.
cli Package cli implements the release-cli Cobra command tree.	Package cli implements the release-cli Cobra command tree.
cli/mocks Package mocks provides generated CLI composition test doubles.	Package mocks provides generated CLI composition test doubles.
execx Package execx runs external programs with the release CLI's shared process policy.	Package execx runs external programs with the release CLI's shared process policy.
profile/goprof Package goprof selects canonical Linux binaries from GoReleaser artifacts.json.	Package goprof selects canonical Linux binaries from GoReleaser artifacts.json.
rel Package rel is the pure release model: versions, digests, tags, and tag plans.	Package rel is the pure release model: versions, digests, tags, and tag plans.
stage Package stage verifies a GoReleaser dist bundle against its checksum claim.	Package stage verifies a GoReleaser dist bundle against its checksum claim.
stage/image Package image stages Linux binaries into signed APK repositories and a locked OCI layout, and verifies that layout against the release contract.	Package image stages Linux binaries into signed APK repositories and a locked OCI layout, and verifies that layout against the release contract.
stage/pkgrepo Package pkgrepo validates native packages and builds deterministic static APT, RPM/DNF, and APK repository trees.	Package pkgrepo validates native packages and builds deterministic static APT, RPM/DNF, and APK repository trees.
stage/pubbrew Package pubbrew reconciles one generated Homebrew cask into a protected tap through a reviewable GitHub pull request.	Package pubbrew reconciles one generated Homebrew cask into a protected tap through a reviewable GitHub pull request.
stage/pubgh Package pubgh verifies GitHub Actions artifact handoff metadata, signed release bundles, and the draft GitHub Release publication state machine.	Package pubgh verifies GitHub Actions artifact handoff metadata, signed release bundles, and the draft GitHub Release publication state machine.
stage/puboci Package puboci reads a local OCI layout and publishes digest-addressed content and tags.	Package puboci reads a local OCI layout and publishes digest-addressed content and tags.
stage/pubscoop Package pubscoop reconciles one generated Scoop manifest into a protected bucket through a reviewable GitHub pull request.	Package pubscoop reconciles one generated Scoop manifest into a protected bucket through a reviewable GitHub pull request.