Ci/release like tihole

.claude/whetstone.json

@@ -8,7 +8,9 @@
     "icm": "0.10.61",
     "headroom": "0.34.0"
   },
-  "settings": {},
+  "settings": {
+    "api_model": "claude-opus-5-5"
+  },
   "created_at": "2026-08-12T02:48:17.636827105Z",
-  "updated_at": "2026-08-12T02:48:17.636827105Z"
+  "updated_at": "2026-10-29T03:12:20.525436962Z"
 }

.github/workflows/ci.yml

@@ -10,14 +10,43 @@ permissions:
   contents: read
 
 jobs:
-  test:
+  build-test:
+    name: Build / Vet / Test
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
-      - run: gofmt -l . | (! grep -q .) || (echo "Unformatted files" && exit 1)
-      - run: go vet ./...
-      - run: go build ./...
-      - run: go test ./...
+          cache: true
+
+      - name: gofmt
+        run: |
+          bad="$(gofmt -l .)"
+          if [ -n "$bad" ]; then
+            echo "These files are not gofmt-clean:"
+            echo "$bad"
+            exit 1
+          fi
+
+      - name: golines (max-len 80)
+        run: |
+          go install github.com/segmentio/golines@latest
+          bad="$("$(go env GOPATH)/bin/golines" \
+            --base-formatter=gofmt --max-len=80 \
+            --shorten-comments -l .)"
+          if [ -n "$bad" ]; then
+            echo "These files exceed the 80-col golines gate:"
+            echo "$bad"
+            exit 1
+          fi
+
+      - name: Build
+        run: go build ./...
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...

.github/workflows/release.yml

@@ -1,41 +1,129 @@
 name: Release
 
 on:
+  # Stable releases: `just release` merges a PR that changes VERSION; this
+  # run creates the tag.
   push:
-    tags: ["v*"]
+    branches: [main]
+    paths: [VERSION]
+    # Prereleases: `just prerelease` pushes a vX.Y.Z-beta.N tag directly.
+    tags:
+      - "v*"
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
-  release:
+  check-tag:
+    name: Prepare release metadata
     runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.version.outputs.tag }}
     steps:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+
+      - name: Read version
+        id: version
+        run: |
+          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
+            TAG="${GITHUB_REF_NAME}"
+          else
+            TAG="v$(tr -d '[:space:]' < VERSION)"
+          fi
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          if git rev-parse "${TAG}" >/dev/null 2>&1; then
+            echo "Tag ${TAG} already exists; continuing in recovery mode"
+          else
+            echo "Will create release ${TAG}"
+          fi
+
+  verify:
+    name: Verify release commit
+    needs: check-tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
-      - uses: goreleaser/goreleaser-action@v7
+          cache: true
+
+      - uses: extractions/setup-just@v4
+
+      - name: Release check
+        run: just release-check
+
+  goreleaser:
+    name: goreleaser
+    needs: [check-tag, verify]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
         with:
+          fetch-depth: 0
+
+      # A tag pushed with GITHUB_TOKEN does not start another workflow run,
+      # so creating it here cannot double-release.
+      - name: Create tag if needed
+        env:
+          TAG: ${{ needs.check-tag.outputs.tag }}
+        run: |
+          if git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "Tag $TAG already exists"
+          else
+            git tag "$TAG"
+            git push origin "$TAG"
+          fi
+
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run goreleaser
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: "~> v2"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-checksums: dist/checksums.txt
+
   publish-aur:
-    needs: release
-    if: vars.PUBLISH_TO_AUR == 'true'
+    name: Publish to AUR
+    needs: [check-tag, goreleaser]
+    # Stable releases only; betas never reach the AUR.
+    if: >-
+      vars.PUBLISH_TO_AUR == 'true' &&
+      !contains(needs.check-tag.outputs.tag, '-')
     runs-on: ubuntu-latest
     strategy:
       matrix:
         pkgname: [smbark-bin, smbark]
     steps:
       - uses: actions/checkout@v7
-      - name: Set pkgver from VERSION
+
+      - name: Set pkgver from tag
+        env:
+          TAG: ${{ needs.check-tag.outputs.tag }}
         run: |
-          PKGVER=$(cat VERSION)
-          sed -i "s/^pkgver=.*/pkgver=${PKGVER}/" "aur/${{ matrix.pkgname }}/PKGBUILD"
+          sed -i "s/^pkgver=.*/pkgver=${TAG#v}/" \
+            "aur/${{ matrix.pkgname }}/PKGBUILD"
+
       - name: Publish to AUR
         uses: KSXGitHub/github-actions-deploy-aur@v4.2.0
         with:
@@ -44,5 +132,5 @@ jobs:
           commit_username: Zack Kitzmiller
           commit_email: zackkitzmiller@gmail.com
           ssh_private_key: ${{ secrets.AUR_SSH_KEY }}
-          commit_message: "Update to ${{ github.ref_name }}"
+          commit_message: "Update to ${{ needs.check-tag.outputs.tag }}"
           updpkgsums: true

.gitignore

@@ -10,3 +10,5 @@
 # OS cruft
 .DS_Store
 *~
+CLAUDE.local.md
+CLAUDE.local.md

.goreleaser.yml

@@ -1,7 +1,18 @@
+# goreleaser configuration for smbark.
+# Docs: https://goreleaser.com
 version: 2
 
+project_name: smbark
+
+before:
+  hooks:
+    - go mod tidy
+
 builds:
-  - env:
+  - id: smbark
+    main: .
+    binary: smbark
+    env:
       - CGO_ENABLED=0
     goos:
       - linux
@@ -11,12 +22,34 @@ builds:
     ldflags:
       - -s -w
 
+# Raw binaries, not archives: site/install.sh, the site's download links
+# and aur/smbark-bin fetch releases/download/vX.Y.Z/smbark-linux-<arch>.
 archives:
-  - format: binary
+  - id: smbark
+    formats: [binary]
     name_template: "{{ .ProjectName }}-{{ .Os }}-{{ .Arch }}"
 
 checksum:
-  name_template: checksums.txt
+  name_template: "checksums.txt"
+  algorithm: sha256
+
+snapshot:
+  version_template: "{{ incpatch .Version }}-next"
 
 changelog:
-  use: github-native
+  use: github
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+      - "^chore:"
+      - "^ci:"
+
+release:
+  github:
+    owner: z19r
+    name: smbark
+  draft: false
+  prerelease: auto
+  name_template: "v{{ .Version }}"

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+All notable changes to smbark will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
 ## [Unreleased]
 
 ## [1.2.1] - 2026-08-19
@@ -49,3 +54,10 @@
 - TOML configuration support
 - Fuzzy-search share filtering
 - Project site with Netlify deployment
+
+[Unreleased]: https://github.com/z19r/smbark/compare/v1.2.1...HEAD
+[1.0.0]: https://github.com/z19r/smbark/releases/tag/v1.0.0
+[1.0.1]: https://github.com/z19r/smbark/releases/tag/v1.0.1
+[1.1.0]: https://github.com/z19r/smbark/releases/tag/v1.1.0
+[1.2.0]: https://github.com/z19r/smbark/releases/tag/v1.2.0
+[1.2.1]: https://github.com/z19r/smbark/releases/tag/v1.2.1