Artifact [943389f9a9]

Artifact 943389f9a905fe08d2d68505736645acf1d6d9bbea56fa7337b2ed89ca2b5d3d:

• File .github/workflows/release.yml — part of check-in [af8e531e68] at 2026-10-03 19:00:27 on branch trunk — ci(release): drop the downstream dispatch to EdgeSync (#251)

  The release workflow's last step sent EdgeSync an upstream-bump event with a personal access token. It has failed with 401 on every release since v0.8.1 because the token expired, marking each release run failed after the release itself was published. EdgeSync also stopped accepting the event when the repository was renamed.

  EdgeSync now tracks go-libfossil with Dependabot (danmestas/EdgeSync #199), which needs no token here, so the step is removed. A release run now succeeds once the GitHub release exists. (user: [email protected], size: 2533) [annotate] [blame] [check-ins using]

name: Release
on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # The go-libfossil rename left temporary `replace` directives bridging the
      # in-repo modules to local paths. A tag carrying them breaks
      # `go install github.com/danmestas/go-libfossil/cmd/libfossil@<tag>` and any
      # `@version` fetch of the driver submodules, because Go refuses a main module
      # that contains replace directives. Unblock a release by cutting new tags for
      # the submodules with the corrected module paths, bumping the root module's
      # requires to those versions, then deleting the replace blocks (and the stale
      # old-path lines they leave behind in the go.sum files).
      - name: Guard against replace directives
        run: |
          offenders=$(git ls-files '*go.mod' | xargs -r grep -l '^replace' || true)
          if [ -n "$offenders" ]; then
            echo "::error::refusing to release: go.mod replace directives present in:"
            echo "$offenders"
            exit 1
          fi

      # A pseudo-version names a bare commit rather than a tag. When the commit
      # comes from a PR branch that is later squash-merged, the original is
      # rewritten and orphaned, so the require line resolves only for as long as
      # proxy.golang.org keeps its cached copy; anything on direct git (e.g.
      # GOPRIVATE=github.com/danmestas/*) fails outright. That shipped in v0.7.0
      # unnoticed because CI reads through the proxy. In-repo modules must
      # therefore reference each other by released tag only. Unblock a release by
      # pointing the offending requires at the current tag and running
      # `go mod tidy` in each affected module.
      - name: Guard against in-repo pseudo-version requires
        run: |
          offenders=$(git ls-files '*go.mod' | xargs -r grep -nE \
            'github\.com/danmestas/go-libfossil(/[^[:space:]]+)?[[:space:]]+v[0-9][^[:space:]]*[-.][0-9]{14}-[0-9a-f]{12}' || true)
          if [ -n "$offenders" ]; then
            echo "::error::refusing to release: in-repo pseudo-version requires present:"
            echo "$offenders"
            exit 1
          fi

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "${{ github.ref_name }}" \
            --generate-notes \
            --verify-tag