chore: harden the release pipeline and installers - #3
Merged
Merged
Conversation
Drop the unused winget token from the release job, stop running tests with release credentials, use commit timestamps for reproducible builds, add workflow concurrency groups and a gomod cooldown, require HTTPS and TLS 1.2 in the installers, preserve REG_EXPAND_SZ PATH entries on Windows, and document the security reporting channel.
jwmoss
force-pushed
the
chore/harden-release-pipeline
branch
from
September 12, 2026 01:09
f4096a6 to
924e078
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-ups from the 1.0.3 supply-chain security audit. No CLI behavior changes.
release.yml: dropWINGET_TOKEN(unused whileskip_upload: true), add a non-cancelling concurrency group, document thecontents: writescope.ci.yml: cancel-in-progress concurrency group..goreleaser.yaml: remove thebefore: hookstest run from the credentialed job (CI already runs it), setmod_timestampand useCommitDatefor the build date.dependabot.yml: 7-day cooldown for gomod, matching actions.install.sh:--proto '=https' --proto-redir '=https' --tlsv1.2, exact checksum entry match via awk.install.ps1: force TLS 1.2 on PowerShell 5.1,-UseBasicParsing, exact checksum match, and read/write the user PATH asREG_EXPAND_SZso%VAR%entries survive.SECURITY.md: reporting link, response window, supported versions, distribution note.Test plan
shellcheck,shfmt,actionlint,zizmor --persona pedantic(4 informational: unnamed jobs, left as-is because branch protection keys on job ids)goreleaser checkandgoreleaser release --snapshot --cleanproduce 6 archives;built:shows the commit dateinstall.ps1parses under pwsh; PATH registry change not exercised on Windows