chore(release): publish binary-only release artifacts #220

New issue

Closed

opened 2026-05-16 13:53:04 -07:00 by jwilger · 0 comments

jwilger commented

2026-05-16 13:53:04 -07:00

Owner

Goal

Simplify release automation so official releases publish the Linux auto-review binary artifact and provenance files only, with no Docker image promotion.

Implements the binary-only release artifact portion of ADR-0018.

Scope

Update .forgejo/workflows/release-prepare.yml to remove release-candidate Docker image wording.
Update .forgejo/workflows/release-publish.yml to remove:
- release-candidate image digest lookup
- image promotion to version/latest tags
- Docker image release-note lines
- image-only trusted tool setup
Keep binary artifact publication:
- auto-review-$VERSION-linux-x86_64.tar.gz
- SHA256SUMS
- SHA256SUMS.sig
- signing public key
- allowed-signers
- SBOM
- provenance
Keep token-bearing publish guardrails, but simplify them around binary publication only.
Build the release artifact through the Nix production packaging path so embedded OCI rootfs/runtime support is included.
Update release, quickstart, deployment, operations, and threat-model docs affected by the final release shape.

Acceptance Criteria

Release PRs describe binary release candidates only.
Final release publication creates Forgejo Release assets for the binary archive and verification/provenance files.
Final release publication does not inspect, copy, tag, or mention Docker images.
Release artifacts still include the embedded OCI runtime/rootfs support required by auto-review gateway.
Docs and threat model match the binary-only release workflow.

Verification

Focused release artifact build succeeds.
nix build .#packages.x86_64-linux.ar-cli-portable-release-root or equivalent succeeds.
just ci

Dependencies

Blocked by #218 and #219.

## Goal Simplify release automation so official releases publish the Linux `auto-review` binary artifact and provenance files only, with no Docker image promotion. Implements the binary-only release artifact portion of ADR-0018. ## Scope - Update `.forgejo/workflows/release-prepare.yml` to remove release-candidate Docker image wording. - Update `.forgejo/workflows/release-publish.yml` to remove: - release-candidate image digest lookup - image promotion to version/latest tags - Docker image release-note lines - image-only trusted tool setup - Keep binary artifact publication: - `auto-review-$VERSION-linux-x86_64.tar.gz` - `SHA256SUMS` - `SHA256SUMS.sig` - signing public key - `allowed-signers` - SBOM - provenance - Keep token-bearing publish guardrails, but simplify them around binary publication only. - Build the release artifact through the Nix production packaging path so embedded OCI rootfs/runtime support is included. - Update release, quickstart, deployment, operations, and threat-model docs affected by the final release shape. ## Acceptance Criteria - Release PRs describe binary release candidates only. - Final release publication creates Forgejo Release assets for the binary archive and verification/provenance files. - Final release publication does not inspect, copy, tag, or mention Docker images. - Release artifacts still include the embedded OCI runtime/rootfs support required by `auto-review gateway`. - Docs and threat model match the binary-only release workflow. ## Verification - Focused release artifact build succeeds. - `nix build .#packages.x86_64-linux.ar-cli-portable-release-root` or equivalent succeeds. - `just ci` ## Dependencies Blocked by #218 and #219.

jwilger added the

enhancement

label

2026-05-16 13:53:16 -07:00

jwilger added this to the 1.0 milestone

2026-05-16 13:54:04 -07:00

jwilger added a new dependency

2026-05-16 13:54:42 -07:00

#218 chore(ci): run PR checks as parallel just-based Forgejo jobs

jwilger added a new dependency

2026-05-16 13:54:42 -07:00

#219 refactor(release): remove official Docker image build outputs