Encore adds imports at build time, so go mod tidy prunes go.sum entries
that the Encore build needs, and every batch failed with a missing go.sum
entry. Add go-mod-tidy, on by default, so an Encore app can turn it off.
Renovate wrote the lockfile with its own pnpm, in a form the pinned pnpm
rejected as an overrides mismatch, so every branch failed to install. Pass
pnpm-version to Renovate as a constraint.
An Encore app cannot be tested with plain go build and go test. Add
go-prepare-command, which runs before the tests, and go-test-command, which
replaces the default Go build and test commands.
A repo with no packageManager field got the newest pnpm through Corepack.
Several repos pin pnpm in their own workflows instead. Add a pnpm-version
input to node-pr and renovate-autoupdate and activate it with corepack.
A repo can have more than one workflow that a push used to trigger, such
as a Docker build and a site deploy. Let release-workflow take a
comma-separated list and dispatch each one.
Renovate queries the repository issues when it starts. The job token had
no issues permission, so a private repo returned FORBIDDEN and Renovate
stopped with platform-unknown-error. Public repos expose issues, which hid
the problem. Grant issues: read to the Renovate job.
Add a reusable workflow that installs without changing the lockfile and
runs lint, typecheck, test and build, skipping scripts that do not exist.
It follows go-pr: a push to a branch with an open PR skips the duplicate
run, and stale runs are cancelled.
Renovate updated every go.mod and package.json in a repo, while the tests
cover one module and one Node project. An update outside them would merge
untested. Restrict the managers to the configured directories, and add go
and node switches for a repo that has no Go code or no frontend to test.
A Go major update changes the import path. Without rewriting imports the
PR only added the new module to go.mod, the tests passed, and Renovate
proposed it again. Rewrite the imports with gomodUpdateImportPaths so the
build tests the actual update, and cap indirect dependencies at their
current major, which the parent module decides.
The checkout used the triggering ref, so a run started from another
branch tested a stale tree and then hit conflicts. Check out the default
branch explicitly. When a passing PR conflicts, close it and skip, and
when the merge fails, close the PR and fail the job. Only a real test
failure goes to the issue.
Renovate skips a branch when a PR with the same title was closed, and
adds a comment to that PR. A PR closed after a merge or by hand must not
block the next update, so set recreateWhen to always.
A failing update has no PR, so its test output had nowhere to go. Capture
the output of the Go and Node steps. On failure, write it as a comment on
one sticky issue, one comment per branch, updated on every run. A final
job removes comments for branches that are gone and closes the issue when
no update fails. The step is best effort and also writes the run summary.
Renovate now prepares branches and opens no PR. Each branch is merged
into the default branch locally and tested, one at a time. Only a branch
that passes gets a PR, which merges at once, so a failing update never
shows up as a PR. Majors default to one branch each. The release is
dispatched once, after anything merged.
A repo with a backlog of majors got one PR per major on the first run.
Replace include-major with major-updates: ignore (default), separate or
batch. Ignore uses a version cap, because rules that disable by update
type have no effect.
The workflow runs inside the calling repository, so its own token is
enough and no PAT is needed. Drop the PAT fallbacks and make admin merge
opt-in, because the workflow token cannot bypass branch protection.
A merge made with that token does not trigger push workflows, so add a
release-workflow input that dispatches the release after the merge.
Renovate batches every minor and patch update in one PR. The workflow
tests that branch with go build and go test for Go and with the
package.json scripts for npm, pnpm and yarn. It squash-merges the PR only
when every test passes. Major updates get their own PR and never merge by
themselves. A renovate.json in the calling repo adds project rules.
The continue command that merges split builds stops after 30 minutes by
default. A slow multi-architecture docker build under QEMU hit that
limit and the superclaw release failed with context canceled after
30 minutes.
The goreleaser action takes a timeout input, default 60m, and passes it
to release, release --split and continue --merge. The release workflows
expose it as release-timeout.
The unpinned latest binfmt image can crash arm64 apt installs with a segmentation fault.
Pin the image to a known stable release for reproducible multi-arch builds.
The coverage step matched every line that contains the word total, so a
function name such as subtotal added a second value. GitHub then
rejected the multi-line step output. The step now reads the line that
starts with total:.
go get -u updates indirect modules past the versions their parents
support. For Kubernetes projects the build then fails and the daily
update has failed since early September. The step now builds after a
full update. On failure it restores go.mod and go.sum and updates the
direct dependencies only.
The Go toolchain also uses check-latest so a range such as >=1.24
resolves to the newest release.
A run cancelled by a newer push still ran the report job. The gate then
failed and marked the superseded run as failed. The report job now
skips when the run is cancelled.
The && operator bound to the first operand only, so the label branch
returned the bare label before the format call. Parentheses keep the
whole fallback chain on the && branch.
A caller can grant narrower permissions than the release job needs. The
release then fails at the end, when it creates the tag or pushes an
image.
The preflight job now declares the same contents and packages
permissions as the release job and probes with the real token. A git
push dry run checks that the token can create the tag and release. A
ghcr.io token request and a blob upload session check that the token can
push the image. The upload session creates no package.
The release-cgo workflow probes ghcr only when the GoReleaser config
builds ghcr.io images. The release workflow probes it when
docker-enabled is true and the registry is ghcr.io. A probe that cannot
reach a verdict warns and does not fail.
A release run used to fail at the GoReleaser step when a secret was
empty, after the tests and the version job had finished.
A new preflight action checks the required names, the .Env references
in the GoReleaser config and push access to optional repositories. It
lists every problem in one run. The release and release-cgo workflows
run it in a first job, so a missing secret fails in seconds.
The release-cgo workflow requires GORELEASER_PRO. The release workflow
requires the secrets that the GoReleaser config references. Set the
preflight input to false to skip the check. Set preflight-repos to check
access to a Homebrew tap or helm-charts repository.
The workflow takes the same runner input as the release workflows.
Findings from go vet and staticcheck now appear as inline annotations
on the pull request diff. A new report job posts one comment with the
result of every check and the coverage. It fails when a check fails or
coverage is below the threshold. It no longer needs the bc command.
A push to a branch with an open pull request now skips its run, because
the pull_request event already runs the checks. Stale runs on the same
branch are cancelled. Every job has a timeout.
The release, release-cgo and autoupdate workflows must run on a runner
the caller chooses. Each workflow now takes a runner input. It accepts
a label or a JSON object that selects a runner group.
The workflow uses inputs.runner first. It then uses the
SHARED_ACTIONS_RUNNER variable and falls back to ubuntu-latest. Callers
that set nothing keep the old behaviour.
Every job now has a timeout. Release and autoupdate runs use a
concurrency group that never cancels a running job.
create-pull-request and the gh pr merge step both hard-required HOMEBREW_TAP_TOKEN,
so any consumer repo without that secret got 'Input token not supplied' and the
whole Autoupdate run failed. A same-repo PR needs only the caller's
contents/pull-requests write; fall back to the auto-provisioned github.token.
Consumers that do set the tap token keep current behavior.
Lets a caller run the release jobs on a self-hosted runner via with.runner,
e.g. runner: self-hosted. Defaults to ubuntu-latest so existing consumers are
unaffected.
Before tagging, fold any working-tree changes left by a repo-local workflow-prepare.sh (e.g. version stamping) into the tagged commit. Without this the tag captured the unstamped source AND GoReleaser's 'release --clean' failed on the dirty tree. The commit is reachable only via the tag (the branch is not pushed), so a 0.0.0-dev placeholder on main is preserved. No-op when the tree is clean, so repos that do not stamp are unaffected.
The release job now passes the calculated semver (bare VERSION and v-prefixed VERSION_TAG) into the repo-local workflow-prepare.sh hook's environment, so a consumer repo can stamp its version into source at build time. Needed for runtimes that cannot resolve their version from build info at runtime (e.g. Yaegi-interpreted Traefik plugins). Additive and backward-compatible: the test/version jobs run the hook without a version, and repos with no hook (or one that ignores VERSION) are unaffected.
goreleaser Pro's --split mode pushes Docker images during the
per-target build job (see 'pushing docker images from partial release'
in goreleaser output). The shared workflow previously only logged in
to ghcr.io during the merge job, so the build-phase push failed with
'unauthorized: unauthenticated: User cannot be authenticated with the
token provided'.
Added docker/login-action + docker/setup-buildx-action to the build
step, gated on matrix.goos == 'linux' since Docker images are
Linux-only in every consumer of this workflow. Uses the default
GITHUB_TOKEN, which has packages:write per the existing permissions
block.
- Add build-tags input parameter to go-test action
- Add build-tags input to go-pr workflow with CGO support
- Pass build-tags to go-test action in go-release-cgo workflow
- Enable CGO_ENABLED=1 in go-pr test job
This allows projects requiring CGO and build tags (e.g., SQLite FTS5)
to properly compile and test with sqlite-vec and other CGO dependencies.
Fixes test failures for projects using sqlite-vec-go-bindings.
Added Docker buildx setup with docker-container driver to support
multi-platform Docker image builds in the release job.
Changes:
- Set up Docker buildx with moby/buildkit driver
- Login to GitHub Container Registry before GoReleaser
This fixes the error:
"Multi-platform build is not supported for the docker driver"
The release job needs an explicit if condition to run even when optional
jobs like frontend are skipped. Without this, GitHub Actions skips the
release job when any dependency doesn't have 'success' status.
Now release will run as long as version and build jobs succeed.
Allow repos to optionally run a ./workflow-prepare.sh script
after checkout to handle any pre-build setup like downloading
dependencies or generating files.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
- Add goreleaser-key input for Pro license
- Use goreleaser-pro distribution for split/merge modes
- Split: goreleaser release --clean --split
- Merge: goreleaser continue --merge
- Pass GORELEASER_PRO secret to action
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
Since GoReleaser Pro is needed for split/merge, use this approach:
- Split mode: goreleaser release --skip=publish --single-target (builds + archives)
- Merge mode: gh CLI to create release and upload artifacts
This allows CGO matrix builds without requiring Pro license.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
- Change merge mode to use 'release --skip=build' since binaries are pre-built
- Upload full dist/ directory, not just files with extensions
- This ensures binary directories are preserved across the artifact upload/download
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
macOS-13 runners are deprecated, switching to macos-15-large for
darwin_amd64 builds.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
--split flag is GoReleaser Pro only. Use 'build --single-target' for
matrix builds and 'release --clean' for the merge step.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
- Add frontend job that builds Node.js frontend once on ubuntu
- Platform builds now download the frontend artifact
- New inputs: node-cache-dependency-path, node-output-path, node-embed-path
- Reduces build time by avoiding redundant frontend builds on each platform
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
lukaszraczylo
