chore(scaffold): CI (build/test/lint) + goreleaser matrix + composite-action bootstrap

bosun commented

2026-07-24 22:42:29 +02:00

Owner

Wire up the CI + release-asset pipeline for the Go substrate.

Scope

.forgejo/workflows/go-ci.yml (or extend existing tests.yml): go build, go test ./..., golangci-lint run
.goreleaser.yaml matrix (Linux amd64 minimum; ARM64 + macOS/Windows deferred to §9 open sub-fork #1 disposition)
Composite action action.yml at repo root (per ADR-0008 §4a lean D) — fetches + verifies + invokes the released rt binary. Shape is minimal per ADR-0009 §9 not-included note ("prototyping in Phase 0a")
First alpha tag v1.0.0-alpha.0 publishes the empty-scaffold binary as end-to-end asset-pipeline smoke

AC

Go CI runs on PR + push, all three steps green — verified: run 18831 green on PR#517 (pull_request event, first Go-code CI pass), run 18832+ green on v2/next push events
goreleaser produces rt-linux-amd64 binary on tag push — verified: run 18828 SUCCESS on tag v1.0.0-alpha.0 at 271cc01 (after PR#514 token-fix + retag), release published with rt-linux-amd64 (3920KB) + checksums.txt
Composite action wiring: a scratch consumer workflow invokes rt --version via the composite; succeeds — verified: composite-smoke run 18835 SUCCESS on v2/next @ 2de5372 (workflow_dispatch, version=v1.0.0-alpha.0), fetched live asset with token-auth + HTML-content-guard per PR#515 hardening
v1.0.0-alpha.0 tagged + released with the scaffold binary attached — verified: release published 2026-07-25T00:13:54+02:00 (prerelease=true, draft=false) at tag pointing to 271cc0150c, 2 assets attached

Refs ADR-0009 §3.3 phase 0a, §9 (composite-action shape prototyping).

Wire up the CI + release-asset pipeline for the Go substrate. ## Scope - `.forgejo/workflows/go-ci.yml` (or extend existing tests.yml): `go build`, `go test ./...`, `golangci-lint run` - `.goreleaser.yaml` matrix (Linux amd64 minimum; ARM64 + macOS/Windows deferred to §9 open sub-fork #1 disposition) - Composite action `action.yml` at repo root (per ADR-0008 §4a lean D) — fetches + verifies + invokes the released `rt` binary. Shape is minimal per ADR-0009 §9 not-included note ("prototyping in Phase 0a") - First alpha tag `v1.0.0-alpha.0` publishes the empty-scaffold binary as end-to-end asset-pipeline smoke ## AC - [x] Go CI runs on PR + push, all three steps green — verified: run 18831 green on PR#517 (pull_request event, first Go-code CI pass), run 18832+ green on v2/next push events - [x] goreleaser produces `rt-linux-amd64` binary on tag push — verified: run 18828 SUCCESS on tag v1.0.0-alpha.0 at 271cc01 (after PR#514 token-fix + retag), release published with rt-linux-amd64 (3920KB) + checksums.txt - [x] Composite action wiring: a scratch consumer workflow invokes `rt --version` via the composite; succeeds — verified: composite-smoke run 18835 SUCCESS on v2/next @ 2de5372 (workflow_dispatch, version=v1.0.0-alpha.0), fetched live asset with token-auth + HTML-content-guard per PR#515 hardening - [x] `v1.0.0-alpha.0` tagged + released with the scaffold binary attached — verified: release published 2026-07-25T00:13:54+02:00 (prerelease=true, draft=false) at tag pointing to 271cc0150ca59dc3a6ba70657e1921320891b711, 2 assets attached Refs ADR-0009 §3.3 phase 0a, §9 (composite-action shape prototyping).

bosun added this to the Phase 0a — Scaffold + harness framework milestone

2026-07-24 22:42:29 +02:00

bosun added the

priority/high

size/M

kind/chore

labels

2026-07-24 22:42:29 +02:00

engineer referenced this issue from a commit

2026-07-24 23:04:57 +02:00

feat(scaffold): Go module + cmd/rt cobra skeleton + internal package stubs (#501)

engineer referenced this issue

2026-07-24 23:05:31 +02:00

feat(scaffold): Go module + cmd/rt cobra skeleton + internal package stubs (#501) #510

engineer referenced this issue from a commit

2026-07-24 23:16:24 +02:00

feat(scaffold): Go module + cmd/rt cobra skeleton + internal package stubs (#501)

shipwright self-assigned this

2026-07-24 23:26:14 +02:00

shipwright referenced this issue from a commit

2026-07-24 23:38:13 +02:00

chore(scaffold): CI (go-ci) + goreleaser + composite-action bootstrap (#502)

shipwright referenced this issue

2026-07-24 23:39:11 +02:00

chore(scaffold): CI (go-ci) + goreleaser + composite-action bootstrap (#502) #511

engineer referenced this issue from a commit

2026-07-24 23:42:08 +02:00

feat(harness): byte-equivalence differential harness framework (#503)

engineer referenced this issue

2026-07-24 23:43:42 +02:00

feat(harness): byte-equivalence differential harness framework (#503) #512

shipwright referenced this issue

2026-07-24 23:47:31 +02:00

Asset-signature verification for the composite action (authenticity, not just integrity) — R6 follow-up to #502 #513

shipwright referenced this issue from a commit

2026-07-24 23:54:27 +02:00

fix(goreleaser): unset ambient GITHUB_TOKEN so goreleaser sees one token (#502)

shipwright referenced this issue

2026-07-24 23:54:42 +02:00

fix(goreleaser): unset ambient GITHUB_TOKEN so goreleaser sees one token (#502) #514

engineer referenced this issue from a commit

2026-07-24 23:58:18 +02:00

feat(harness): byte-equivalence differential harness framework (#503)

engineer referenced this issue

2026-07-25 00:06:28 +02:00

feat(harness): byte-equivalence differential harness framework (#503) #512

bosun referenced this issue from a commit

2026-07-25 00:07:35 +02:00

feat(harness): byte-equivalence differential harness framework (#503)

bosun referenced this issue

2026-07-25 00:07:52 +02:00

feat(scaffold): equivalence-harness framework (bash-oracle runner + observable-surface capture + diff) #503

bosun referenced this issue from a commit

2026-07-25 00:11:33 +02:00

fix(goreleaser): unset ambient GITHUB_TOKEN so goreleaser sees one token (#502)

shipwright referenced this issue from a commit

2026-07-25 00:20:20 +02:00

fix(action): authenticated asset fetch + fail-loud HTML guard (#502)

shipwright referenced this issue

2026-07-25 00:20:37 +02:00

fix(action): authenticated asset fetch + fail-loud HTML guard (#502) #515

shipwright referenced this issue from a commit

2026-07-25 00:36:20 +02:00

fix(action): authenticated asset fetch + fail-loud HTML guard (#502)

bosun closed this issue

2026-07-25 00:39:31 +02:00

bosun commented

2026-07-25 00:39:31 +02:00

Author

Owner

Closed by hand — Phase 0a #502 (CI + goreleaser + composite-action bootstrap) complete. 4/4 ACs ticked with substrate anchors above.

Merged PRs in this arc:

PR#511 (initial delivery: 6 workflow/action artifacts) → merged 3af1442
PR#514 (goreleaser dual-token fix: unset GITHUB_TOKEN) → merged 271cc01
PR#515 (composite-smoke auth-token + fail-loud HTML-content-guard) → merged 2de5372

Sibling merges enabling Phase 0a:

PR#510 (#501 scaffold) → merged d4f8f88 → d74175b base
PR#512 (#503 harness) → merged 16a21c5 (via server-side rebase from 314fb2e)
PR#517 (#516 errcheck base-fix, unblocked #515) → merged d9f611c

First alpha release live: v1.0.0-alpha.0 at 271cc01, rt-linux-amd64 (3.9MB) + checksums.txt published. End-to-end asset pipeline verified: build → goreleaser → publish → composite-fetch → checksum-verify → invoke rt --version → green.

Substrate discoveries codified in this arc:

Forgejo runner auto-injects GITHUB_TOKEN → goreleaser v2 refuses dual GITHUB_TOKEN/GITEA_TOKEN (fixed PR#514)
workflow_dispatch on tag ref loads OLD workflow file from tag tree; dispatch on branch to get FIXED workflow (Shipwright substrate discovery)
Forgejo REQUIRE_SIGNIN_VIEW=true silently substitutes HTML sign-in page for anonymous asset downloads (HTTP 200 masks it); composite needs token-auth + HTML content-guard for portability (fixed PR#515)
Pre-gate merge with delayed gate-red on downstream: #503 merged un-linted because base predated go-ci.yml; reddened v2/next go-ci for the next innocent PR (#515). Rebase-onto-gated-base-before-merge norm worth codifying (process follow-up).

Cross-references:

#513 (R6 asset-signature verification, non-blocking; filed by Shipwright per Surveyor's non-must-fix) — deferred
#516 (errcheck base-fix tracker) — closed alongside PR#517 merge
ADR-0009 §3.3 phase 0a row: CLOSED SUBSTRATE-HONEST

Phase 0a status: 3/3 complete (#501 scaffold + #503 harness + #502 CI+goreleaser+composite). Ready for Phase 0b dispatch (#504 contract-first types + #505 config schema + #506 CI matrix expansion or as decomposed).

**Closed by hand** — Phase 0a #502 (CI + goreleaser + composite-action bootstrap) complete. 4/4 ACs ticked with substrate anchors above. Merged PRs in this arc: - **PR#511** (initial delivery: 6 workflow/action artifacts) → merged 3af1442 - **PR#514** (goreleaser dual-token fix: unset GITHUB_TOKEN) → merged 271cc01 - **PR#515** (composite-smoke auth-token + fail-loud HTML-content-guard) → merged 2de5372 Sibling merges enabling Phase 0a: - **PR#510** (#501 scaffold) → merged d4f8f88 → d74175b base - **PR#512** (#503 harness) → merged 16a21c5 (via server-side rebase from 314fb2e) - **PR#517** (#516 errcheck base-fix, unblocked #515) → merged d9f611c **First alpha release live**: v1.0.0-alpha.0 at 271cc01, rt-linux-amd64 (3.9MB) + checksums.txt published. End-to-end asset pipeline verified: build → goreleaser → publish → composite-fetch → checksum-verify → invoke rt --version → green. **Substrate discoveries codified in this arc**: 1. Forgejo runner auto-injects GITHUB_TOKEN → goreleaser v2 refuses dual GITHUB_TOKEN/GITEA_TOKEN (fixed PR#514) 2. workflow_dispatch on tag ref loads OLD workflow file from tag tree; dispatch on branch to get FIXED workflow (Shipwright substrate discovery) 3. Forgejo REQUIRE_SIGNIN_VIEW=true silently substitutes HTML sign-in page for anonymous asset downloads (HTTP 200 masks it); composite needs token-auth + HTML content-guard for portability (fixed PR#515) 4. Pre-gate merge with delayed gate-red on downstream: #503 merged un-linted because base predated go-ci.yml; reddened v2/next go-ci for the next innocent PR (#515). Rebase-onto-gated-base-before-merge norm worth codifying (process follow-up). **Cross-references**: - #513 (R6 asset-signature verification, non-blocking; filed by Shipwright per Surveyor's non-must-fix) — deferred - #516 (errcheck base-fix tracker) — closed alongside PR#517 merge - ADR-0009 §3.3 phase 0a row: **CLOSED SUBSTRATE-HONEST** **Phase 0a status: 3/3 complete** (#501 scaffold + #503 harness + #502 CI+goreleaser+composite). Ready for Phase 0b dispatch (#504 contract-first types + #505 config schema + #506 CI matrix expansion or as decomposed).

engineer referenced this issue

2026-07-25 02:16:54 +02:00

feat(cli): rt subcommand skeleton + trivalent exit-code wiring (#506) #522

engineer referenced this issue from a commit

2026-07-26 21:48:40 +02:00

feat(scaffold): Go module + cmd/rt cobra skeleton + internal package stubs (#501)

engineer referenced this issue from a commit

2026-07-26 21:48:40 +02:00

chore(scaffold): CI (go-ci) + goreleaser + composite-action bootstrap (#502)

engineer referenced this issue from a commit

2026-07-26 21:48:40 +02:00

feat(harness): byte-equivalence differential harness framework (#503)