release: v0.1.0 signed supply chain

.github/dependabot.yml

@@ -0,0 +1,34 @@
+version: 2
+
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: America/Chicago
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      go-runtime:
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:30"
+      timezone: America/Chicago
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -14,14 +14,16 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GO_VERSION: "1.26.x"
+  GO_VERSION: "1.26.5"
   GOLANGCI_VERSION: "v2.12.2"
   GOVULNCHECK_VERSION: "v1.6.0"
+  GORELEASER_VERSION: "v2.17.0"
+  SYFT_VERSION: "v1.46.0"
 
 jobs:
   build-test-lint:
     name: build · vet · gofmt · lint · test · e2e
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
         with:
@@ -30,7 +32,7 @@ jobs:
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: ${{ env.GO_VERSION }}
-          check-latest: true
+          check-latest: false
           cache: true
           cache-dependency-path: go.sum
 
@@ -62,7 +64,7 @@ jobs:
 
       - name: Vulnerability scan
         run: |
-          go install golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}
+          go install "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}"
           govulncheck ./...
 
       - name: Build
@@ -82,3 +84,38 @@ jobs:
 
       - name: Real two-cluster fan-out test
         run: make e2e-kind KIND="$(go env GOPATH)/bin/kind"
+
+  release-snapshot:
+    name: reproducible archives · SPDX SBOM · Homebrew formula
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: false
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: Install pinned Syft
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          syft-version: ${{ env.SYFT_VERSION }}
+
+      - name: Install pinned GoReleaser
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: ${{ env.GORELEASER_VERSION }}
+          install-only: true
+
+      - name: Download and verify modules
+        run: |
+          go mod download
+          go mod verify
+
+      - name: Verify release snapshot and rebuild reproducibility
+        run: make release-check

.github/workflows/release.yml

@@ -0,0 +1,164 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  GO_VERSION: "1.26.5"
+  GORELEASER_VERSION: "v2.17.0"
+  SYFT_VERSION: "v1.46.0"
+  COSIGN_VERSION: "v3.0.6"
+
+jobs:
+  release:
+    name: build · sign · attest · publish
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Validate stable tag and release ancestry
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::release tags must be stable semantic versions such as v0.1.0"
+            exit 1
+          fi
+          git fetch --no-tags origin main
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
+            echo "::error::release tag must point to a commit reachable from main"
+            exit 1
+          fi
+          if [ "$(git cat-file -t "$GITHUB_REF_NAME")" != "tag" ]; then
+            echo "::error::release tag must be annotated"
+            exit 1
+          fi
+          tag_object=$(git rev-parse "$GITHUB_REF_NAME^{tag}")
+          if [ "$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${tag_object}" --jq '.verification.verified')" != "true" ]; then
+            echo "::error::release tag must carry a signature verified by GitHub"
+            exit 1
+          fi
+          echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
+
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          check-latest: false
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: Install pinned Syft
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          syft-version: ${{ env.SYFT_VERSION }}
+
+      - name: Install pinned Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: ${{ env.COSIGN_VERSION }}
+
+      - name: Download and verify modules
+        run: |
+          go mod download
+          go mod verify
+
+      - name: Build signed draft release
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: ${{ env.GORELEASER_VERSION }}
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Verify release assets and render Homebrew formula
+        run: |
+          go run ./tools/releasecheck verify --dist dist
+          go run ./tools/releasecheck formula \
+            --dist dist \
+            --tag "$GITHUB_REF_NAME" \
+            --output dist/sith.rb
+
+      - name: Sign Homebrew formula
+        run: cosign sign-blob --yes --bundle=dist/sith.rb.sigstore.json dist/sith.rb
+
+      - name: Generate SLSA build provenance
+        id: provenance
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        with:
+          subject-checksums: dist/checksums.txt
+
+      - name: Attest darwin amd64 SBOM
+        id: sbom_darwin_amd64
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        with:
+          subject-path: dist/sith_${{ env.VERSION }}_darwin_amd64.tar.gz
+          sbom-path: dist/sith_${{ env.VERSION }}_darwin_amd64.tar.gz.spdx.json
+
+      - name: Attest darwin arm64 SBOM
+        id: sbom_darwin_arm64
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        with:
+          subject-path: dist/sith_${{ env.VERSION }}_darwin_arm64.tar.gz
+          sbom-path: dist/sith_${{ env.VERSION }}_darwin_arm64.tar.gz.spdx.json
+
+      - name: Attest linux amd64 SBOM
+        id: sbom_linux_amd64
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        with:
+          subject-path: dist/sith_${{ env.VERSION }}_linux_amd64.tar.gz
+          sbom-path: dist/sith_${{ env.VERSION }}_linux_amd64.tar.gz.spdx.json
+
+      - name: Attest linux arm64 SBOM
+        id: sbom_linux_arm64
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        with:
+          subject-path: dist/sith_${{ env.VERSION }}_linux_arm64.tar.gz
+          sbom-path: dist/sith_${{ env.VERSION }}_linux_arm64.tar.gz.spdx.json
+
+      - name: Attach attestations and Homebrew formula
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PROVENANCE_BUNDLE: ${{ steps.provenance.outputs.bundle-path }}
+          SBOM_DARWIN_AMD64_BUNDLE: ${{ steps.sbom_darwin_amd64.outputs.bundle-path }}
+          SBOM_DARWIN_ARM64_BUNDLE: ${{ steps.sbom_darwin_arm64.outputs.bundle-path }}
+          SBOM_LINUX_AMD64_BUNDLE: ${{ steps.sbom_linux_amd64.outputs.bundle-path }}
+          SBOM_LINUX_ARM64_BUNDLE: ${{ steps.sbom_linux_arm64.outputs.bundle-path }}
+        run: |
+          set -euo pipefail
+          install -m 0644 "$PROVENANCE_BUNDLE" "dist/sith_${VERSION}_provenance.sigstore.json"
+          install -m 0644 "$SBOM_DARWIN_AMD64_BUNDLE" "dist/sith_${VERSION}_darwin_amd64.sbom.sigstore.json"
+          install -m 0644 "$SBOM_DARWIN_ARM64_BUNDLE" "dist/sith_${VERSION}_darwin_arm64.sbom.sigstore.json"
+          install -m 0644 "$SBOM_LINUX_AMD64_BUNDLE" "dist/sith_${VERSION}_linux_amd64.sbom.sigstore.json"
+          install -m 0644 "$SBOM_LINUX_ARM64_BUNDLE" "dist/sith_${VERSION}_linux_arm64.sbom.sigstore.json"
+          gh release upload "$GITHUB_REF_NAME" \
+            dist/sith.rb \
+            dist/sith.rb.sigstore.json \
+            "dist/sith_${VERSION}_provenance.sigstore.json" \
+            "dist/sith_${VERSION}_darwin_amd64.sbom.sigstore.json" \
+            "dist/sith_${VERSION}_darwin_arm64.sbom.sigstore.json" \
+            "dist/sith_${VERSION}_linux_amd64.sbom.sigstore.json" \
+            "dist/sith_${VERSION}_linux_arm64.sbom.sigstore.json" \
+            --clobber
+
+      - name: Publish completed release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release edit "$GITHUB_REF_NAME" --draft=false --latest