Renovate batches every minor and patch update in one PR. The workflow
tests that branch with go build and go test for Go and with the
package.json scripts for npm, pnpm and yarn. It squash-merges the PR only
when every test passes. Major updates get their own PR and never merge by
themselves. A renovate.json in the calling repo adds project rules.
The continue command that merges split builds stops after 30 minutes by
default. A slow multi-architecture docker build under QEMU hit that
limit and the superclaw release failed with context canceled after
30 minutes.
The goreleaser action takes a timeout input, default 60m, and passes it
to release, release --split and continue --merge. The release workflows
expose it as release-timeout.
The unpinned latest binfmt image can crash arm64 apt installs with a segmentation fault.
Pin the image to a known stable release for reproducible multi-arch builds.
The coverage step matched every line that contains the word total, so a
function name such as subtotal added a second value. GitHub then
rejected the multi-line step output. The step now reads the line that
starts with total:.
go get -u updates indirect modules past the versions their parents
support. For Kubernetes projects the build then fails and the daily
update has failed since early September. The step now builds after a
full update. On failure it restores go.mod and go.sum and updates the
direct dependencies only.
The Go toolchain also uses check-latest so a range such as >=1.24
resolves to the newest release.
A run cancelled by a newer push still ran the report job. The gate then
failed and marked the superseded run as failed. The report job now
skips when the run is cancelled.
The && operator bound to the first operand only, so the label branch
returned the bare label before the format call. Parentheses keep the
whole fallback chain on the && branch.
A caller can grant narrower permissions than the release job needs. The
release then fails at the end, when it creates the tag or pushes an
image.
The preflight job now declares the same contents and packages
permissions as the release job and probes with the real token. A git
push dry run checks that the token can create the tag and release. A
ghcr.io token request and a blob upload session check that the token can
push the image. The upload session creates no package.
The release-cgo workflow probes ghcr only when the GoReleaser config
builds ghcr.io images. The release workflow probes it when
docker-enabled is true and the registry is ghcr.io. A probe that cannot
reach a verdict warns and does not fail.
A release run used to fail at the GoReleaser step when a secret was
empty, after the tests and the version job had finished.
A new preflight action checks the required names, the .Env references
in the GoReleaser config and push access to optional repositories. It
lists every problem in one run. The release and release-cgo workflows
run it in a first job, so a missing secret fails in seconds.
The release-cgo workflow requires GORELEASER_PRO. The release workflow
requires the secrets that the GoReleaser config references. Set the
preflight input to false to skip the check. Set preflight-repos to check
access to a Homebrew tap or helm-charts repository.
The workflow takes the same runner input as the release workflows.
Findings from go vet and staticcheck now appear as inline annotations
on the pull request diff. A new report job posts one comment with the
result of every check and the coverage. It fails when a check fails or
coverage is below the threshold. It no longer needs the bc command.
A push to a branch with an open pull request now skips its run, because
the pull_request event already runs the checks. Stale runs on the same
branch are cancelled. Every job has a timeout.
The release, release-cgo and autoupdate workflows must run on a runner
the caller chooses. Each workflow now takes a runner input. It accepts
a label or a JSON object that selects a runner group.
The workflow uses inputs.runner first. It then uses the
SHARED_ACTIONS_RUNNER variable and falls back to ubuntu-latest. Callers
that set nothing keep the old behaviour.
Every job now has a timeout. Release and autoupdate runs use a
concurrency group that never cancels a running job.
create-pull-request and the gh pr merge step both hard-required HOMEBREW_TAP_TOKEN,
so any consumer repo without that secret got 'Input token not supplied' and the
whole Autoupdate run failed. A same-repo PR needs only the caller's
contents/pull-requests write; fall back to the auto-provisioned github.token.
Consumers that do set the tap token keep current behavior.
Lets a caller run the release jobs on a self-hosted runner via with.runner,
e.g. runner: self-hosted. Defaults to ubuntu-latest so existing consumers are
unaffected.
Before tagging, fold any working-tree changes left by a repo-local workflow-prepare.sh (e.g. version stamping) into the tagged commit. Without this the tag captured the unstamped source AND GoReleaser's 'release --clean' failed on the dirty tree. The commit is reachable only via the tag (the branch is not pushed), so a 0.0.0-dev placeholder on main is preserved. No-op when the tree is clean, so repos that do not stamp are unaffected.
The release job now passes the calculated semver (bare VERSION and v-prefixed VERSION_TAG) into the repo-local workflow-prepare.sh hook's environment, so a consumer repo can stamp its version into source at build time. Needed for runtimes that cannot resolve their version from build info at runtime (e.g. Yaegi-interpreted Traefik plugins). Additive and backward-compatible: the test/version jobs run the hook without a version, and repos with no hook (or one that ignores VERSION) are unaffected.
goreleaser Pro's --split mode pushes Docker images during the
per-target build job (see 'pushing docker images from partial release'
in goreleaser output). The shared workflow previously only logged in
to ghcr.io during the merge job, so the build-phase push failed with
'unauthorized: unauthenticated: User cannot be authenticated with the
token provided'.
Added docker/login-action + docker/setup-buildx-action to the build
step, gated on matrix.goos == 'linux' since Docker images are
Linux-only in every consumer of this workflow. Uses the default
GITHUB_TOKEN, which has packages:write per the existing permissions
block.
- Add build-tags input parameter to go-test action
- Add build-tags input to go-pr workflow with CGO support
- Pass build-tags to go-test action in go-release-cgo workflow
- Enable CGO_ENABLED=1 in go-pr test job
This allows projects requiring CGO and build tags (e.g., SQLite FTS5)
to properly compile and test with sqlite-vec and other CGO dependencies.
Fixes test failures for projects using sqlite-vec-go-bindings.
Added Docker buildx setup with docker-container driver to support
multi-platform Docker image builds in the release job.
Changes:
- Set up Docker buildx with moby/buildkit driver
- Login to GitHub Container Registry before GoReleaser
This fixes the error:
"Multi-platform build is not supported for the docker driver"
The release job needs an explicit if condition to run even when optional
jobs like frontend are skipped. Without this, GitHub Actions skips the
release job when any dependency doesn't have 'success' status.
Now release will run as long as version and build jobs succeed.
Allow repos to optionally run a ./workflow-prepare.sh script
after checkout to handle any pre-build setup like downloading
dependencies or generating files.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
- Add goreleaser-key input for Pro license
- Use goreleaser-pro distribution for split/merge modes
- Split: goreleaser release --clean --split
- Merge: goreleaser continue --merge
- Pass GORELEASER_PRO secret to action
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
Since GoReleaser Pro is needed for split/merge, use this approach:
- Split mode: goreleaser release --skip=publish --single-target (builds + archives)
- Merge mode: gh CLI to create release and upload artifacts
This allows CGO matrix builds without requiring Pro license.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
- Change merge mode to use 'release --skip=build' since binaries are pre-built
- Upload full dist/ directory, not just files with extensions
- This ensures binary directories are preserved across the artifact upload/download
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
macOS-13 runners are deprecated, switching to macos-15-large for
darwin_amd64 builds.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
--split flag is GoReleaser Pro only. Use 'build --single-target' for
matrix builds and 'release --clean' for the merge step.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
- Add frontend job that builds Node.js frontend once on ubuntu
- Platform builds now download the frontend artifact
- New inputs: node-cache-dependency-path, node-output-path, node-embed-path
- Reduces build time by avoiding redundant frontend builds on each platform
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
lukaszraczylo
