From a7165ddcb94819a36195cf61eb542f0a068546b3 Mon Sep 17 00:00:00 2001 From: Rob Lauer Date: Thu, 29 Oct 2026 10:51:52 -0500 Subject: [PATCH 1/2] ci: harden workflows and fix macOS deployment target - release: pin macos-26 and set MACOSX_DEPLOYMENT_TARGET=15.0 so darwin binaries no longer require the runner's macOS version (v1.12.1+ shipped with minos 26.0); fail the run if any darwin binary drifts from it - release: add a tag input to workflow_dispatch, disable the setup-go cache, set contents: write, keep artifacts 7 days - audit: run go test, cover the lib module, read-only permissions, cancel superseded PR runs - build with Go 1.26 (1.25 is EOL) and bump all actions to latest majors - add Dependabot for GitHub Actions Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 16 ++++++++++++++++ .github/workflows/audit.yml | 30 +++++++++++++++++++++++++----- .github/workflows/release.yml | 34 +++++++++++++++++++++++++++------- 3 files changed, 68 insertions(+), 12 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..0a30165 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,16 @@ +version: 2 + +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 5 + commit-message: + prefix: "chore(actions)" + groups: + actions-minor-patch: + update-types: + - "minor" + - "patch" diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 69889c8..b7b5511 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -6,23 +6,35 @@ on: pull_request: branches: [ master ] +permissions: + contents: read + +concurrency: + group: ci-${{ github.workflow }}-${{ github.ref }}${{ github.ref == 'refs/heads/master' && format('-{0}', github.sha) || '' }} + cancel-in-progress: ${{ github.ref != 'refs/heads/master' }} + jobs: audit: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v7 with: - go-version: '1.25.0' + go-version: '1.26' + cache-dependency-path: | + go.sum + lib/go.sum - name: Verify dependencies - run: go mod verify + run: | + go mod verify + go -C lib mod verify - name: Build @@ -30,4 +42,12 @@ jobs: - name: Run go vet - run: go vet ./... + run: | + go vet ./... + go -C lib vet ./... + + - + name: Run tests + run: | + go test ./... + go -C lib test ./... diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f58f0c6..eb2b799 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,27 +4,38 @@ on: release: types: [published] workflow_dispatch: + inputs: + tag: + description: Existing tag to build and publish + required: true + +permissions: + contents: write jobs: goreleaser: - runs-on: macos-latest + runs-on: macos-26 + env: + MACOSX_DEPLOYMENT_TARGET: '15.0' steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: + ref: ${{ inputs.tag }} fetch-depth: 0 - name: Fetch all tags run: git fetch --force --tags - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@v7 with: - go-version: '1.25.0' + go-version: '1.26' + cache: false - name: Generate Homebrew tap token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@v3 id: tap-token with: app-id: ${{ secrets.TAP_APP_ID }} @@ -33,7 +44,7 @@ jobs: repositories: homebrew-note-cli - name: Run GoReleaser - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@v7 with: distribution: goreleaser version: '~> v2' @@ -43,7 +54,16 @@ jobs: TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }} - name: Upload assets - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: note-cli path: dist/* + retention-days: 7 + - + name: Verify macOS deployment target + run: | + for bin in dist/*_darwin_*/note*; do + minos=$(otool -l "$bin" | awk '/LC_BUILD_VERSION/{f=1} f && /minos/{print $2; exit}') + echo "$bin: minos $minos" + test "$minos" = "$MACOSX_DEPLOYMENT_TARGET" + done From 6f38ae75e1250d379684e6603c1e726530de2adb Mon Sep 17 00:00:00 2001 From: Rob Lauer Date: Thu, 29 Oct 2026 10:58:14 -0500 Subject: [PATCH 2/2] ci: check macOS deployment target before publishing Move the minos check from a post-release workflow step into a GoReleaser post-build hook so a mismatched darwin binary fails the build stage before any archive, GitHub release asset, or Homebrew cask update is produced. MACOSX_DEPLOYMENT_TARGET now lives in .goreleaser.yaml so local snapshot builds match CI. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yml | 10 ---------- .goreleaser.yaml | 13 +++++++++++++ 2 files changed, 13 insertions(+), 10 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index eb2b799..a04df19 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,8 +15,6 @@ permissions: jobs: goreleaser: runs-on: macos-26 - env: - MACOSX_DEPLOYMENT_TARGET: '15.0' steps: - name: Checkout @@ -59,11 +57,3 @@ jobs: name: note-cli path: dist/* retention-days: 7 - - - name: Verify macOS deployment target - run: | - for bin in dist/*_darwin_*/note*; do - minos=$(otool -l "$bin" | awk '/LC_BUILD_VERSION/{f=1} f && /minos/{print $2; exit}') - echo "$bin: minos $minos" - test "$minos" = "$MACOSX_DEPLOYMENT_TARGET" - done diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 93e98d8..ffeac85 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -1,5 +1,8 @@ version: 2 +env: + - MACOSX_DEPLOYMENT_TARGET=15.0 + before: hooks: - go mod tidy @@ -52,6 +55,15 @@ builds: goarm: 6 - goos: windows goarch: arm64 + hooks: &macos-minos-check + post: + - cmd: >- + sh -c 'case "$0" in darwin_*) + minos=$(otool -l "$1" | awk "/LC_BUILD_VERSION/{f=1} f && /minos/{print \$2; exit}"); + echo "$1: minos $minos"; + test "$minos" = "$MACOSX_DEPLOYMENT_TARGET";; + esac' "{{ .Target }}" "{{ .Path }}" + output: true - id: "notehub" @@ -72,6 +84,7 @@ builds: goarm: 6 - goos: windows goarch: arm64 + hooks: *macos-minos-check checksum: name_template: 'checksums.txt'