mroberts
a829aa774f
build / build and release (push) Has been cancelled
Ports the build-and-release pipeline from .drone.yml to .gitea/workflows/release.yaml. Same three amd64 targets, same release-on-tag trigger. Actions are pinned to full commit SHAs resolved from gitea.com, the runner's action resolution host. Its mirror of actions/checkout lags upstream, so the floating v4 tag there points at a different commit than github's; only immutable version tags agree across both hosts. checkout stays on v4 and setup-go on v5 because later majors require a Node 24 runtime that act_runner images do not generally ship. Hardening driven by zizmor: workflow-level permissions denied by default with contents:write scoped to the job that publishes the release, persist-credentials disabled so the token is not left in .git/config, and the Go module cache disabled so released binaries cannot be built from restorable cache state. Behaviour changes: - sha1 checksums dropped; gitea-release-action only emits md5 and sha256 - the gitea_public_releases secret is no longer read, as the action defaults to the runner-injected repo token - Go version now comes from go.mod rather than the floating golang image Also gitignores the usergen build output, which dist/* missed. Verified: go build, go vet and go test clean; all three cross-compile targets produce binaries; actionlint and zizmor --offline report no findings. The release step itself is unverified until a tag is pushed.
25 lines
514 B
Plaintext
25 lines
514 B
Plaintext
# If you prefer the allow list template instead of the deny list, see community template:
|
|
# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
|
|
#
|
|
# Binaries for programs and plugins
|
|
*.exe
|
|
*.exe~
|
|
*.dll
|
|
*.so
|
|
*.dylib
|
|
|
|
# Test binary, built with `go test -c`
|
|
*.test
|
|
|
|
# Output of the go coverage tool, specifically when used with LiteIDE
|
|
*.out
|
|
|
|
# Dependency directories (remove the comment below to include it)
|
|
# vendor/
|
|
|
|
# Go workspace file
|
|
go.work
|
|
dist/*
|
|
|
|
# Local build output
|
|
usergen |