Add release.yml — wohl-hub binaries with SBOM, sums, sig, attestation#22
Merged
Conversation
First release pipeline for wohl. Adapts pulseengine/synth's
release.yml (the cross-repo reference per the release-standardization
brief), tailored for wohl-hub's specifics:
Targets
- x86_64-unknown-linux-gnu (MiniPC / generic Linux hub)
- aarch64-unknown-linux-gnu (Raspberry Pi 4/5; primary deployment
per spar/wohl_nodes.aadl)
- x86_64-apple-darwin (dev convenience)
- aarch64-apple-darwin (dev convenience)
aarch64-linux uses the native `ubuntu-24.04-arm` runner instead of
cross-rs — cross's docker container doesn't mount the parent dir,
which would break wohl-hub's `path = "../relay/..."` sibling-path
workspace deps; a native runner sidesteps that friction.
relay sibling checked out with fetch-depth: 0 at the pinned
RELAY_REF (kept in lock-step with ci.yml).
Required release assets (matches the standardization brief exactly):
wohl-hub-vX.Y.Z-<triple>.tar.gz binary archives (x 4 targets)
wohl-hub-X.Y.Z.cdx.json CycloneDX SBOM (CDX 1.5)
SHA256SUMS.txt sha256sum over every asset
SHA256SUMS.txt.sig cosign detached signature
SHA256SUMS.txt.pem Fulcio certificate
SHA256SUMS.txt.cosign.bundle cosign verifier bundle
build-env.txt rustc/cargo/cosign/runner
SBOM is generated *before* SHA256SUMS so its digest is in the
manifest; the cosign signature over SHA256SUMS.txt transitively
covers the SBOM.
Provenance + signing
- actions/attest-build-provenance@v2 generates SLSA v1 build
provenance for every .tar.gz (GitHub-native; consumers verify
with `gh attestation verify <file> --repo pulseengine/wohl`).
- sigstore/cosign-installer@v3 cosign v2.4.1; keyless OIDC
sign-blob over SHA256SUMS.txt producing the
.sig / .pem / .cosign.bundle triple.
Triggers
- push: tags: ['v*'] (the primary path)
- workflow_dispatch (manual re-run for a partially-failed release;
requires the existing tag as input)
- Concurrency group per-tag, never cancels in flight.
- Idempotent on re-run via gh release upload --clobber.
Permissions
- Workflow-level: contents: read.
- create-release job: contents: write + id-token: write +
attestations: write (minimum for asset upload + keyless signing
+ SLSA attestation).
No release has been cut yet — `gh release list` is empty. Merging
this PR does NOT fire the workflow (tag trigger only). First
exercise is `git tag v0.1.0 && git push --tags`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First release pipeline for wohl. Adopts the pulseengine release-standardization brief (synth pattern as reference). No release has been cut yet — this PR adds the machinery; the first
git tag v0.1.0 && git push --tagsexercises it end-to-end.Adopted from the brief
wohl-hub-vX.Y.Z-<triple>.tar.gzcargo build --release -p wohl-hubper targetwohl-hub-X.Y.Z.cdx.jsoncargo cyclonedx --manifest-path crates/wohl-hub/Cargo.toml --format json --spec-version 1.5SHA256SUMS.txtsha256sum ./*over the directory after SBOM is generatedSHA256SUMS.txt.sig/.pem/.cosign.bundlecosign sign-blob(cosign v2.4.1)build-env.txtactions/attest-build-provenance@v2,subject-path: release-assets/*.tar.gzPermissions on the create-release job:
contents: write,id-token: write,attestations: write(per the brief).Targets
x86_64-unknown-linux-gnu— MiniPC / generic Linux hubaarch64-unknown-linux-gnu— Raspberry Pi 4/5 (primary deployment perspar/wohl_nodes.aadl)x86_64-apple-darwin,aarch64-apple-darwin— dev convenienceaarch64-linux uses the native
ubuntu-24.04-armrunner instead ofcross-rs. wohl-hub haspath = "../relay/..."sibling deps and cross's docker container doesn't mount the parent dir — a native runner sidesteps that friction.relay sibling
Same
RELAY_REFSHA asci.yml(kept in lock-step; bump together), withfetch-depth: 0so relay force-pushes don't break release builds (lesson from #21).Verification one-liner — paste into release notes
Notes
push: tags: ['v*']andworkflow_dispatch(manual re-run for partially-failed releases).cancel-in-progress: false— never cancels mid-publish.--clobberinstead of failing.🤖 Generated with Claude Code