Add a Prod build and a QC build#14
Merged
Merged
Conversation
This branch replaced the auto-discovered root .goreleaser.yml with two env-specific configs but placed them under dist/, which is gitignored, so they never reached CI — the release job failed with "open dist/config.yaml: no such file or directory". (goreleaser's --clean also wipes dist/ at startup, so committing them there would not work either.) Relocate both to a tracked .goreleaser/ directory and point the release and develop workflows at the new paths. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- ServeHTTP now HTML-escapes the error/error_description query params before interpolating them into the error page, preventing reflected XSS via the localhost redirect URL. - The release tag guard fetches origin/main* explicitly before git branch --contains, since tag pushes don't populate remote-tracking refs and the check would otherwise fail on legitimate main tags. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Snapshot (--snapshot) dispatches now build with config-qc.yaml so they produce QC binaries, and the resulting dist artifacts are uploaded to the workflow run as qc-snapshot-artifacts for download. Previously snapshot runs used the prod config and uploaded nothing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Snapshot runs previously bundled every artifact under a single qc-snapshot-artifacts entry, which GitHub serves as one combined zip. Upload each platform archive (and checksums.txt) as its own artifact so the Actions run lists them individually. Non-snapshot release runs keep the combined release-artifacts bundle the macOS job depends on. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Previously the release-macos job was gated off entirely for snapshot (QC) builds, so snapshot darwin archives were never signed and only the unsigned placeholders from the build job were available. Now the macOS job runs for snapshot dispatches too: it pulls the individually-uploaded QC artifacts, signs/notarizes the darwin archives, and re-uploads the signed archives (and updated checksums.txt) as individual assets, overwriting the unsigned placeholders. The tag-release path is unchanged — it still downloads the combined release-artifacts bundle and produces macos-signed-artifacts. The artifacts.json checksum patch is skipped when that file is absent (snapshot builds). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merges to develop run develop.yml on every push, so notarizing the macOS builds each time wastes time and Apple notary quota — those are internal QC artifacts, not externally distributed. Drop the notarytool submit step and the now-unused APPLE_ID/APPLE_ID_PASSWORD/APPLE_TEAM_ID env vars, keeping codesign + verify. Notarization is retained for snapshot dispatches and tagged releases in release.yml. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
neil-gall
approved these changes
Jun 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add configuration files for production and QC environments; update main.go to reference them