[seantronsen]

Description

Release branch for v4.0.0 (milestone). The v4 PR stack merges into seantronsen/release-400; this PR lands it on main once the milestone is complete.

Review the individual PRs; this one only collects them.

Important

Merge with a rebase commit to keep the per-step commits.

Closes #35, closes #36, closes #37, closes #42, closes #43, closes #49

Note

This release effectively is comprised of edits which, (1) consolidate all potentially reusable workflows across all org repos into this actions repo and (2) cleanup/refactor all CI/CD routines to improve re-usability, readability, ergonomics, and correctness.

Release notes

Consolidation release: brings the org's reusable CI/CD workflows into this repo and rebuilds releases around GoReleaser. Releases are signed through the key chain with one signature over checksums.txt instead of per-package signatures. Adds shared Makefile.common, docs link checking, and Fabrica codegen checks; standardizes names and inputs on kebab-case; moves lightweight jobs to ubuntu-slim; and pins every third-party action to a commit SHA.

Breaking changes

Removed

Replaced by the GoReleaser workflows (build-check-goreleaser, build-release-goreleaser, validate-packages) and the new signing flow:

• Workflows: build-publish-container-goreleaser, go-build-release, docker-build-release, build-rpm-quadlet, validate-rpm-quadlet, release-signed-artifacts.
• Actions: gpg-configure-release-keys, gpg-sign-rpm, gpg-check-key-expiration, gpg-ephemeral-key.
• coverage-go.yml: use test-unit-go.yml with coverage: true.

Renamed workflows

Old	New
lint-workflows.yml	lint-ci.yml
test-go.yml	test-unit-go.yml
publish-release.yml	release-publish.yml

Signing

• Packages ship unsigned. gpg-sign-artifacts (rewritten) signs GoReleaser's checksums.txt with a per-run release key certified by the repo key, and attaches checksums.txt.asc plus pubkey-{signing,repo,org}.asc through release-modify. The config must set checksum.name_template: checksums.txt.
• Needs only the repo key secret (GPG_REPO_CERT_KEY_B64) and the MASTER_PUBLIC_ASC / MASTER_FPR org secrets. GPG_REPO_KEY_B64 is unused.
• gpg-verify-trust-chain (rewritten) checks the chain against a pinned root fingerprint, the repo key's certified name, expiry/revocation, and file signatures.
• Signing tooling is no longer fetched from gpg-signing-manager at runtime.

See Signing releases.

release-publish (was publish-release)

• Only publishes an existing draft; fails if the release is missing or already public. Uses gh instead of softprops/action-gh-release.
• New draft input (default false); make-latest defaults to legacy (was true).

test-unit-go

• test-command replaced by test-args (arguments to go test, one per line, default -race and ./...). Arbitrary commands are no longer run.
• New: coverage (boolean) and coverage-file (default coverage.out).
• Job (check) name test-go is now test-unit-go; update branch protection and required status checks.

trivy-image-scan

• Removed image-ref. It now scans every GHCR image of the repo at the release tag (pr-<N> on PRs), one job per image. Names come from the new images input, else the GoReleaser config's ghcr.io images, else the repo name. Callers must grant packages: read.

pr-registry-cleanup

• Removed pr-number and tag-prefix; the tag is always pr-<N> from the pull_request event. Cleans every image (same name sources and images input as trivy-image-scan), one job per image, and fails on errors instead of ignoring them. Fork PRs are skipped. Callers must grant contents: read alongside packages: write.

Inputs renamed to kebab-case

Workflow	Old	New
lint-go, test-unit-go	go_version	go-version
	go_version_file	go-version-file
release-publish	make_latest	make-latest
reuse	reuse_version	reuse-version

New

• build-check-goreleaser: snapshot build of everything, publishes nothing.
• build-release-goreleaser: pr-<N> images for PRs; semver images, packages, draft release, and build provenance attestations for v* tags. Picks the mode from the event. Outputs version and images.
• validate-packages: rpm/deb file list, install test, and lint, one job per package.
• release-modify: appends or replaces notes and adds or replaces files on a draft release.
• lint-docs: dead-link check with lychee. Findings go to code scanning on PRs that change docs; on the default branch, one issue is kept up to date and closed once the links are fixed.
• lint-codegen-fabrica: fails when a Fabrica project's committed generated code is out of date.
• lint-makefile-common: fails when a repo's vendored Makefile.common differs from the latest release.
• stale and lint-renovate reusable workflows.
• Makefile.common: shared targets for OpenCHAMI repos (Go, Fabrica, containers, GoReleaser packages, REUSE). See Makefile.common.
• actions/discover-ghcr-images: finds and verifies a repo's GHCR image names.
• runner input (default ubuntu-slim) on test-unit-go, lint-go, govulncheck, trivy-image-scan, and lint-codegen-fabrica, for jobs that outgrow slim's 1 CPU / 15-minute limit.

Migration

Release pipelines move from build-publish-container-goreleaser (or go-build-release / build-rpm-quadlet) to this chain:

build-release-goreleaser -> validate-packages
                         -> gpg-sign-artifacts -> release-modify -> release-publish

See GoReleaser for the config contract and Signing releases for the secrets. The testbed is a working example of every workflow.

Other changes

• Lightweight jobs now run on ubuntu-slim; jobs that need Docker or a distro container stay on ubuntu-latest.
• Third-party actions SHA-pinned and bumped to latest (e.g. actions/checkout v7.0.1, actions/setup-go v7.0.0, zizmor-action v0.6.4).
• Workflow name: now matches the filename; ineffective run-name: keys removed from reusable workflows.
• Repo-local CI renamed to 0-local-ci.yml; it calls lint-ci.yml, lint-renovate.yml, and lint-docs.yml.
• Docs split out of the README into docs/ (workflows, actions, GoReleaser, signing, distribution, Makefile.common).

Full changelog: v3.11...v4.0

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works (exercised in github-actions-testbed)
• I have run make test (or equivalent) locally and all tests pass (actionlint, zizmor)
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.

[seantronsen]

Warning

Do not consider merging until I mark this as ready. I've been using PR stacking to simplify reviews and reduce the overall diff size per PR, with the trade off being that I cannot reliably implement multiple ideas in parallel due to the nature of this repo.

[seantronsen]

Reminder before releasing: update every SHA pin that points at this repo's own stack commits (e.g. discover-ghcr-images@26748ab in trivy-image-scan and pr-registry-cleanup). Restacking and the rebase merge rewrite those commits, so re-pin to commits on main before tagging v4.0.

[seantronsen]

We should move reuse.yml -> lint-reuse.yml and then update the testbed example accordingly.