ci: add MIT license, CI, and tag-driven release workflow - #2
Merged
Conversation
The repo had no CI and no license, and the README described a release process that did not exist: a v1.0.0 tag was pushed but no release was ever cut, so `go install ...@v1.0.0` was the only way to get the tool and nothing was published for users without a Go toolchain. Add MIT LICENSE (copyright DivergentCodes) and two workflows: ci.yml runs on push to main and on PRs: gofmt, vet, `go test -race`, a guard that fails if a third-party dependency ever appears (the project's central claim), and a dogfooding step that lints the commits being built. release.yml triggers on `v*` tags: tests, cross-compiles for linux, darwin, and windows, stamps the tag into main.version via ldflags, verifies the built binary reports the tagged version before publishing, and uploads archives with a checksums.txt alongside autogenerated notes. Update the README's Releases section to describe the actual process and document the prebuilt-binary install path. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VSrrciEDBTuFNMtKocScML
SafeEval
marked this pull request as ready for review
July 30, 2026 16:29
The dogfooding step linted `origin/<base>..HEAD`, but actions/checkout fetches a single shallow branch, so `origin/main` does not exist in the CI clone and git exited 128. It passed locally only because a normal worktree has the full history. Fetch the PR base commit explicitly and lint against that sha instead. Verified against a real `--depth 1` clone, which reproduces the failure before the fetch and resolves the range after it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VSrrciEDBTuFNMtKocScML
On pull_request events actions/checkout checks out the merge commit GitHub builds for the PR, whose subject is `Merge <sha> into <sha>`. That is not a conventional subject, so the dogfooding step failed on a branch whose own commits are all fine. `--no-merges` does not help here: a range endpoint is always included, and HEAD *was* the merge commit. Lint up to the PR's real branch tip instead, fetching both endpoints so the range resolves in the shallow checkout. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VSrrciEDBTuFNMtKocScML
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the two gaps before going public: no license, and a README that documented a release process the repo didn't actually have.
Context
A
v1.0.0tag was pushed at7c41ab2, but no release was ever cut — the Releases page is empty. Sogo install ...@v1.0.0was the only way to get the tool, and there was nothing for users without a Go toolchain. There was also no CI of any kind.LICENSE
MIT,
Copyright (c) 2026 DivergentCodes. Linked from a new README section.ci.yml— push to main, and PRsgofmt(checked via-l, since gofmt exits 0 even when it reformats)go vetgo test -race ./...requireblock ever appears. This repo's central claim is "zero third-party dependencies"; without a check, that silently rots the first time someone adds one. I negative-tested this against a throwaway module with a real dependency to confirm it actually fires rather than passing vacuously.--rangeon PRs and the tip commit on push.release.yml— onv*tagsCutting a release becomes
git tag v1.0.1 && git push origin v1.0.1:CGO_ENABLED=0 -trimpathmain.versionvar via ldflags, socommitlint versionstops reporting0.0.0-dev.tar.gz/.ziparchives (each with LICENSE + README) pluschecksums.txt, with--generate-notespermissions:is scoped per workflow —contents: readfor CI,contents: writeonly for release.Verification
v1.0.1stamped,0.0.0-devunstamped)runblock passesbash -nNote on ordering
Per our discussion, this leaves the existing
v1.0.0tag alone — it predates the comment-stripping fix in #1, so it marks a build where the documented git hook rejects valid commits. Nothing was ever published under it, so no one can be broken. Suggested order: merge #1, merge this, then tagv1.0.1as the first real release. The README already points atv1.0.1.🤖 Generated with Claude Code
https://claude.ai/code/session_01VSrrciEDBTuFNMtKocScML