4 Commits

Author	SHA1	Message	Date
lerko	d1ab842283	ci: harden release pipeline and pin tooling ... Un-neuter grype CVE gate (was || echo, now fails on critical). Add .grype.yaml with ignore for CVE-2026-41589 (wish SCP — unreachable, we only import wish/bubbletea). Pin: grype v0.114.0, git-cliff v2.13.1, govulncheck v1.1.4. Tag `latest` only on tag push, not workflow_dispatch. Build path ./cmd/uptop (survives a main.go split). Add dist/ and uptop to .dockerignore.	2026-06-11 13:03:53 -04:00
lerko	094de23bd0	fix(ci): extract git-cliff to /tmp to avoid dirty worktree ... GoReleaser refuses to release when untracked files exist. The git-cliff tarball was extracting into the workspace, leaving a git-cliff-*/ directory that made git status dirty.	2026-06-02 10:15:47 -04:00
lerko	78fff3fb33	fix(ci): resolve git-cliff download URL dynamically ... Asset naming changed upstream — version number now embedded in filename (git-cliff-2.13.1-x86_64-... instead of git-cliff-x86_64-...). The latest/download shortcut 404s. Query GitHub API for current version and build the correct URL.	2026-06-02 09:42:03 -04:00
lerko	50eb43971c	refactor(ci): split release pipeline, add nfpm/homebrew/git-cliff ... Split monolithic release.yml into independent workflows: - release-binaries.yml: tag-triggered, GoReleaser + git-cliff notes - release-docker.yml: tag-triggered + manual dispatch, SHA tags Add DEB/RPM packaging via nfpm in GoReleaser. Add Homebrew cask config (skip_upload until macOS builds exist). Replace GoReleaser built-in changelog with git-cliff for structured release notes.	2026-06-01 21:14:54 -04:00