ci: pin actions and harden release packaging #633

Merged

fuzzy merged 1 commit from chore/issue-cicd into main

2026-08-11 01:29:47 +00:00

automation commented

2026-08-10 18:43:22 +00:00

Owner

What

Lumped CI/CD issues branch (#522+ cleanup).

#615 — pin reusable actions — thwap-actions/golang-release and thwap-actions/docker-build are now referenced at immutable commit SHAs (880ed2d…, bfedfe4…) instead of the mutable @main ref, so a force-push to those action branches no longer changes this repo's CI/release behavior without review. (No release tags exist on either action repo yet, so a commit SHA is the immutable pin.)
#619 — release finalize fails loudly — the finalize step now validates that cmd/tpagectl/dist and cmd/thwap-pagesd/dist exist and contain binaries, and errors if the number of packaged archives doesn't match the binary count — no more silently shipping a release without .tar.gz/.zip archives if the golang-release output convention changes.
#621 — snap network plugs — the tpagectl snap app declares plugs: [network, home, dbus] so a strict-confined snap can reach the daemon, write the config file, and use Secret Service keychain storage.

Triage — already resolved (closed without code change, after verification):

#614 — Windows release artifacts already carry .exe: both ci.yml and release.yml build via thwap-actions/golang-release, which names Windows binaries tpagectl_<ver>_windows_<arch>.exe (and the finalize step zips those). No manual tpagectl-windows-amd64 naming remains.

Why

Second lump of the #522+ issue cleanup (CI/CD & packaging).

Testing

Workflow YAML + snapcraft.yaml parse; pre-commit "Validate Forgejo Actions files" and "check yaml" pass
Release finalize python block compiles; the missing/empty dist-dir guard raises SystemExit (failing the step)
No Go changes; go test + pre-commit hooks pass

Breaking Changes

None. Pinning to SHAs and failing loudly are additive/behavior-hardening.

Closes #615
Closes #619
Closes #621

## What Lumped CI/CD issues branch (#522+ cleanup). - **#615 — pin reusable actions** — `thwap-actions/golang-release` and `thwap-actions/docker-build` are now referenced at immutable commit SHAs (`880ed2d…`, `bfedfe4…`) instead of the mutable `@main` ref, so a force-push to those action branches no longer changes this repo's CI/release behavior without review. (No release tags exist on either action repo yet, so a commit SHA is the immutable pin.) - **#619 — release finalize fails loudly** — the finalize step now validates that `cmd/tpagectl/dist` and `cmd/thwap-pagesd/dist` exist and contain binaries, and errors if the number of packaged archives doesn't match the binary count — no more silently shipping a release without `.tar.gz`/`.zip` archives if the `golang-release` output convention changes. - **#621 — snap network plugs** — the `tpagectl` snap app declares `plugs: [network, home, dbus]` so a strict-confined snap can reach the daemon, write the config file, and use Secret Service keychain storage. **Triage — already resolved (closed without code change, after verification):** - **#614** — Windows release artifacts already carry `.exe`: both `ci.yml` and `release.yml` build via `thwap-actions/golang-release`, which names Windows binaries `tpagectl_<ver>_windows_<arch>.exe` (and the finalize step zips those). No manual `tpagectl-windows-amd64` naming remains. ## Why Second lump of the #522+ issue cleanup (CI/CD & packaging). ## Testing - [x] Workflow YAML + `snapcraft.yaml` parse; pre-commit "Validate Forgejo Actions files" and "check yaml" pass - [x] Release finalize python block compiles; the missing/empty dist-dir guard raises `SystemExit` (failing the step) - [x] No Go changes; `go test` + pre-commit hooks pass ## Breaking Changes None. Pinning to SHAs and failing loudly are additive/behavior-hardening. Closes #615 Closes #619 Closes #621

automation added 1 commit

2026-08-10 18:43:23 +00:00

ci: pin actions and harden release packaging

CI / build (pull_request) Successful in 9s

Details

CI / test (pull_request) Successful in 5m13s

Details

CI / docker (pull_request) Successful in 3m11s

Details

CI / lint (pull_request) Successful in 5m45s

Details

CI / docker (push) Failing after 56s

Details

CI / test (push) Has been cancelled

Details

CI / lint (push) Has been cancelled

Details

CI / build (push) Has been cancelled

Details

d1eaa43016

- Pin thwap-actions/golang-release and thwap-actions/docker-build to
  immutable commit SHAs instead of the mutable @main refs, so pipeline
  behavior is reproducible (#615).
- The release finalize step now validates that the expected dist
  directories exist and contain binaries, and fails loudly if the number
  of packaged archives does not match the binary count, instead of
  silently shipping a release without archives (#619).
- snapcraft app declares network, home, and dbus plugs so a strict snap
  can reach the daemon, write the config file, and use the keychain
  (#621).

Closes #615
Closes #619
Closes #621