Skip to content

feat: ci improvements - #79

Merged
rdlauer merged 2 commits into
masterfrom
rob-ci-improvements
Oct 30, 2026
Merged

rdlauer merged 2 commits into
masterfrom
rob-ci-improvements

Conversation

@rdlauer

@rdlauer rdlauer commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

As a side effect of looking at migrating runners from github to namespace (which this repo wouldn't benefit from), we discovered some other issues that are addressed in this PR (and reviewed w/ Codex). From Claude:

Summary

  • Fix macOS compatibility. Darwin binaries since v1.12.1 require macOS 26 because cgo builds inherit the runner's OS version (minos 26.0). GoReleaser now sets MACOSX_DEPLOYMENT_TARGET=15.0, and a post-build hook fails the release before anything is published if a darwin binary doesn't match. The release runner is pinned to macos-26 so the build OS stops drifting.
  • Go 1.26. Builds and audit now use the latest Go 1.26 patch instead of 1.25.0, which is end-of-life.
  • audit now runs go test and covers the lib module (verify, vet and test). It uses a read-only token and cancels superseded PR runs.
  • release
    • Manually running it (workflow_dispatch) now takes a tag input, so it no longer fails unless master's latest commit is the tag.
    • Token permission is contents: write.
    • setup-go caching is off.
    • Uploaded artifacts are kept 7 days.
  • Actions are bumped to their latest major versions, and Dependabot now keeps them current.

We evaluated moving to Namespace runners and decided to stay on GitHub-hosted runners. This repo is public, so GitHub's runners are free, and its CI load is too small to benefit.

Testing

  • actionlint passes.
  • Audit commands pass under Go 1.26.10 on Linux.
  • A local GoReleaser v2.19.0 snapshot builds all targets; the darwin binaries report minos 15.0.
  • Forcing a mismatch fails the build before any archives are created.

🤖 Generated with Claude Code

rdlauer and others added 2 commits October 29, 2026 10:51
- release: pin macos-26 and set MACOSX_DEPLOYMENT_TARGET=15.0 so darwin
  binaries no longer require the runner's macOS version (v1.12.1+ shipped
  with minos 26.0); fail the run if any darwin binary drifts from it
- release: add a tag input to workflow_dispatch, disable the setup-go cache,
  set contents: write, keep artifacts 7 days
- audit: run go test, cover the lib module, read-only permissions, cancel
  superseded PR runs
- build with Go 1.26 (1.25 is EOL) and bump all actions to latest majors
- add Dependabot for GitHub Actions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move the minos check from a post-release workflow step into a GoReleaser
post-build hook so a mismatched darwin binary fails the build stage before
any archive, GitHub release asset, or Homebrew cask update is produced.
MACOSX_DEPLOYMENT_TARGET now lives in .goreleaser.yaml so local snapshot
builds match CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rdlauer
rdlauer merged commit e820348 into master Oct 30, 2026
1 check passed
@rdlauer
rdlauer deleted the rob-ci-improvements branch October 30, 2026 13:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants