software-publishing: Add release workflows #1

Merged

free merged 1 commit from engineer/software-publishing into main

2026-05-22 22:13:28 +01:00

AGit

engineer commented

2026-05-22 21:38:59 +01:00

Member

Refs infra/ekanayaka.io#313.

Summary

Bootstrap infra/ekanayaka.io-software with .forgejo/workflows/pi.yml and .forgejo/workflows/hermes.yml.
Each workflow runs on the existing Forgejo host runner (runs-on: debian), derives the version from its tag, builds via infra/ekanayaka.io main, computes a .sha256 sidecar, and uploads both files as Forgejo release assets.
Add a README documenting the release URL shape and the current tag-immutability caveat.

Acceptance evidence

Tag workflow proof:

pi-0.74.0 re-triggered at 4fb5d25; Actions run #9 (pi.yml) finished success.
hermes-2026.4.30 re-triggered at 4fb5d25; Actions run #10 (hermes.yml) finished success.
Final PR head 1c42baf only amends README immutability wording after those green runs: git diff --exit-code 4fb5d25d20edcac34e19e406e198046b117a9778..HEAD -- .forgejo/workflows exited 0.

Release URLs and sha256s:

https://git.ekanayaka.io/infra/ekanayaka.io-software/releases/download/pi-0.74.0/pi-0.74.0.tar.gz
- sha256: 5a403c6eaeea4a75c1ac72372bf1717df819cd3e303c2724abeabfe501fc27a5
https://git.ekanayaka.io/infra/ekanayaka.io-software/releases/download/hermes-2026.4.30/hermes-2026.4.30.tar.gz
- sha256: 80d5e4222c65a68b4a6ebb5c14d319651af30df629e73df1cc33381c34824ede

Download/sha verification after the mergeability gate:

pi-0.74.0.tar.gz: OK
hermes-2026.4.30.tar.gz: OK
post-mergeability release download + sha256 verification: OK

Tarball shape spot-check:

# pi-0.74.0.tar.gz
node_modules/@earendil-works/pi-coding-agent/
node_modules/@earendil-works/pi-coding-agent/package.json
node_modules/@earendil-works/pi-coding-agent/dist/cli.js

# hermes-2026.4.30.tar.gz
lib/
lib/bin/hermes-agent
lib/bin/hermes-acp
lib/bin/hermes

Tag immutability exercise:

create probe tag at HEAD (4fb5d25):
 * [new tag]         immutability-probe-313 -> immutability-probe-313

attempt force-move probe tag to origin/main (a166cc1):
 + 4fb5d25...a166cc1 immutability-probe-313 -> immutability-probe-313 (forced update)
force-push exit code: 0

cleanup probe tag:
 - [deleted]         immutability-probe-313

So this Forgejo instance currently allows force-updating and deleting ordinary tags; the README documents the actual setting and keeps release tags as operator-enforced append-only state until tag protection exists.

Tests

git merge-tree --write-tree origin/main HEAD
# exit 0; mergeability clean

git diff --exit-code 4fb5d25d20edcac34e19e406e198046b117a9778..HEAD -- .forgejo/workflows
# exit 0; workflow code unchanged after the green tag runs

curl -fsSL <release-url> + curl -fsSL <release-url>.sha256 + sha256sum -c
# pi-0.74.0.tar.gz: OK
# hermes-2026.4.30.tar.gz: OK

Refs https://git.ekanayaka.io/infra/ekanayaka.io/issues/313. ## Summary - Bootstrap `infra/ekanayaka.io-software` with `.forgejo/workflows/pi.yml` and `.forgejo/workflows/hermes.yml`. - Each workflow runs on the existing Forgejo host runner (`runs-on: debian`), derives the version from its tag, builds via `infra/ekanayaka.io` `main`, computes a `.sha256` sidecar, and uploads both files as Forgejo release assets. - Add a README documenting the release URL shape and the current tag-immutability caveat. ## Acceptance evidence Tag workflow proof: - `pi-0.74.0` re-triggered at `4fb5d25`; Actions run #9 (`pi.yml`) finished `success`. - `hermes-2026.4.30` re-triggered at `4fb5d25`; Actions run #10 (`hermes.yml`) finished `success`. - Final PR head `1c42baf` only amends README immutability wording after those green runs: `git diff --exit-code 4fb5d25d20edcac34e19e406e198046b117a9778..HEAD -- .forgejo/workflows` exited 0. Release URLs and sha256s: - `https://git.ekanayaka.io/infra/ekanayaka.io-software/releases/download/pi-0.74.0/pi-0.74.0.tar.gz` - sha256: `5a403c6eaeea4a75c1ac72372bf1717df819cd3e303c2724abeabfe501fc27a5` - `https://git.ekanayaka.io/infra/ekanayaka.io-software/releases/download/hermes-2026.4.30/hermes-2026.4.30.tar.gz` - sha256: `80d5e4222c65a68b4a6ebb5c14d319651af30df629e73df1cc33381c34824ede` Download/sha verification after the mergeability gate: ```text pi-0.74.0.tar.gz: OK hermes-2026.4.30.tar.gz: OK post-mergeability release download + sha256 verification: OK ``` Tarball shape spot-check: ```text # pi-0.74.0.tar.gz node_modules/@earendil-works/pi-coding-agent/ node_modules/@earendil-works/pi-coding-agent/package.json node_modules/@earendil-works/pi-coding-agent/dist/cli.js # hermes-2026.4.30.tar.gz lib/ lib/bin/hermes-agent lib/bin/hermes-acp lib/bin/hermes ``` Tag immutability exercise: ```text create probe tag at HEAD (4fb5d25): * [new tag] immutability-probe-313 -> immutability-probe-313 attempt force-move probe tag to origin/main (a166cc1): + 4fb5d25...a166cc1 immutability-probe-313 -> immutability-probe-313 (forced update) force-push exit code: 0 cleanup probe tag: - [deleted] immutability-probe-313 ``` So this Forgejo instance currently allows force-updating and deleting ordinary tags; the README documents the actual setting and keeps release tags as operator-enforced append-only state until tag protection exists. ## Tests ```text git merge-tree --write-tree origin/main HEAD # exit 0; mergeability clean git diff --exit-code 4fb5d25d20edcac34e19e406e198046b117a9778..HEAD -- .forgejo/workflows # exit 0; workflow code unchanged after the green tag runs curl -fsSL <release-url> + curl -fsSL <release-url>.sha256 + sha256sum -c # pi-0.74.0.tar.gz: OK # hermes-2026.4.30.tar.gz: OK ```

engineer added 1 commit

2026-05-22 21:38:59 +01:00

software-publishing: Add release workflows 1c42baf15c