Skip to content

Publish releases automatically with native notes #175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bomly-guy merged 1 commit into from
Jun 18, 2026
+13 −20
Merged

Publish releases automatically with native notes #175

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 2 additions & 10 deletions .goreleaser.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,25 +90,17 @@ snapshot:
version_template: "{{ incpatch .Version }}-next"

changelog:
sort: asc
filters:
exclude:
- "^docs:"
- "^test:"
- "^chore:"
use: github-native

release:
github:
owner: bomly-dev
name: bomly-cli
draft: true
draft: false
prerelease: auto
replace_existing_draft: true
header: |
Bomly release {{ .Tag }}

This draft release was generated by GoReleaser from the tagged `bomly-cli` source tree.

Included artifacts:
- Full builtin `bomly` archives for Linux, macOS, and Windows.
- Alternate `bomly-lite` archives for users who prefer external Syft and Grype binaries.
Expand Down
2 changes: 1 addition & 1 deletion docs/ARCHITECTURE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ GitHub Actions handles validation, security analysis, smoke coverage, and releas

- Pull requests run fast validation only.
- Pushes to `main` run deeper quality checks and scheduled smoke coverage.
- Semver tags run GoReleaser to publish draft GitHub Releases with cross-platform archives, `SHA256SUMS`, Linux packages, and package-manager manifests.
- Semver tags run GoReleaser to publish GitHub Releases with GitHub-native release notes, cross-platform archives, `SHA256SUMS`, Linux packages, and package-manager manifests.

@coderabbitai coderabbitai Bot Jun 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add a decision-log entry for the release approval boundary change.

At Line 195, the behavior change is documented, but the non-obvious design choice (“Auto Version tag creation is the manual approval gate”) is not captured in the Architecture decision log.

As per coding guidelines, "Update docs/ARCHITECTURE.md with pipeline diagram changes when the stage list changes and add decision-log entries for non-obvious design choices."

Suggested doc addition 
+### Decision: Tag creation is the manual release approval gate
+
+The manual approval boundary for releases is running `Auto Version`, which creates the semver tag.
+After release-workflow validation, GoReleaser publishes the GitHub Release automatically so package-manager PRs can reference public assets and checksums immediately.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/ARCHITECTURE.md` at line 195, The behavior change at line 195 describing
Semver tags running GoReleaser is documented, but the design rationale for why
Auto Version tag creation serves as the manual approval gate is not captured in
the decision log section of the ARCHITECTURE.md file. Add a decision-log entry
in docs/ARCHITECTURE.md that explicitly documents this non-obvious design
choice, explaining that Auto Version tag creation is the designated manual
approval gate for the release workflow and why this design decision was made.
This ensures future developers understand the intentional release approval
boundary without having to infer it from the behavior description alone.

Source: Coding guidelines

- GoReleaser also opens package-manager manifest PRs for Homebrew, Scoop, and WinGet. Official distro repositories are intentionally out of scope until usage justifies the maintainer overhead.

See [CI and Release Pipeline](development/CI.md) for workflow details and release mechanics.
Expand Down
12 changes: 7 additions & 5 deletions docs/development/CI.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Bomly uses GitHub Actions for validation, security analysis, smoke coverage, and
| `Smoke` | Merge queue, nightly schedule, manual dispatch | Slow end-to-end coverage against real repositories, SBOMs, and containers before merge, plus scheduled drift detection |
| `Update Smoke Goldens` | Manual dispatch | Regenerate golden files on a chosen ref and open a PR when the changes are intentional |
| `Auto Version` | Manual dispatch | Bump `cmd/bomly/main.go`, create a semver tag, and start the release workflow |
| `Release` | Semver tags like `v1.2.3`, manual dispatch | GoReleaser packaging, checksums, Linux packages, package-manager manifests, and draft GitHub release publication |
| `Release` | Semver tags like `v1.2.3`, manual dispatch | GoReleaser packaging, checksums, Linux packages, package-manager manifests, and GitHub release publication |

## Required Checks

Expand Down Expand Up @@ -160,7 +160,7 @@ go build -tags "bomly_external_syft,bomly_external_grype" -o bin/bomly-lite ./cm

Release packaging is driven by `.goreleaser.yaml`. The release workflow uses GoReleaser to create:

- GitHub Release archives for `bomly` and `bomly-lite`.
- A published GitHub Release with archives for `bomly` and `bomly-lite`.
- `SHA256SUMS`.
- Linux `.deb`, `.rpm`, `.apk`, and Arch Linux package artifacts for the full `bomly` binary.
- Homebrew cask, Scoop, and WinGet manifest pull requests.
Expand All @@ -179,9 +179,11 @@ Release packaging is driven by `.goreleaser.yaml`. The release workflow uses GoR
- `windows/amd64`
- `windows/arm64`
6. GoReleaser generates `SHA256SUMS` and Linux packages.
7. GoReleaser creates a **draft release** in GitHub Releases and uploads archives, packages, and checksums.
7. GoReleaser publishes the GitHub Release, using the configured GoReleaser header plus GitHub-native generated release notes, and uploads archives, packages, and checksums.
8. GoReleaser opens or updates package-manager manifest PRs for Homebrew, Scoop, and WinGet.
9. After the draft release is published, the `Notify landing page (release lifecycle)` workflow dispatches the landing-page docs and changelog sync with the published timestamp.
9. After the release is published, the `Notify landing page (release lifecycle)` workflow dispatches the landing-page docs and changelog sync with the published timestamp.

The manual approval point for a release is the `Auto Version` workflow that creates the release tag. The GitHub Release is intentionally published automatically after validation so package-manager manifest PRs can reference public release assets and checksums.

Version bump rules are chosen explicitly when running `Auto Version`:

Expand All @@ -201,7 +203,7 @@ Archive naming follows this pattern:

Linux package artifacts follow the same `bomly_<version>_<os>_<arch>` prefix with package-manager-specific extensions.

See [Release Checklist](RELEASE_CHECKLIST.md) before publishing a draft release.
See [Release Checklist](RELEASE_CHECKLIST.md) before running the release workflow.

## Install Script Hosting

Expand Down
7 changes: 3 additions & 4 deletions docs/development/RELEASE_CHECKLIST.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ Use this checklist when publishing a tagged Bomly CLI release.

- Run `Auto Version` from `main`, choosing `patch`, `minor`, or `major`.
- Wait for `Release` to finish.
- Review the draft GitHub release:
- Review the published GitHub release:
- `bomly` archives exist for Linux, macOS, and Windows on `amd64` and `arm64`.
- `bomly-lite` archives exist for the same platforms.
- `SHA256SUMS` exists.
Expand All @@ -23,7 +23,7 @@ Use this checklist when publishing a tagged Bomly CLI release.

## Verification

Run the checks against the draft release tag before publishing. Replace `VERSION` in the examples below with the actual release tag, such as `v0.2.0`.
Run the checks against the published release tag. Replace `VERSION` in the examples below with the actual release tag, such as `v0.2.0`.

```bash
gh release download VERSION --pattern SHA256SUMS --pattern 'bomly_VERSION_linux_amd64.tar.gz'
Expand Down Expand Up @@ -51,7 +51,6 @@ scoop install bomly

## Publish and rollback

- Publish the GitHub draft release after verification.
- Merge package-manager PRs after their generated manifests pass review.
- Confirm the landing-page docs sync PR opened.
- If a release must be pulled, mark the GitHub release as draft again and close package-manager PRs that reference the bad tag.
- If a release must be pulled, mark the GitHub release as a prerelease or delete it, close package-manager PRs that reference the bad tag, and tag a replacement patch release when appropriate.