Automated Releases

Goal

Every Git tag produces trustworthy artifacts without a maintainer laptop build.

Why

Build pipeline.

Minimal GitHub Actions shape

  1. Workflow triggers on push tags v*

  2. Job matrix builds each OS/arch you support

  3. Inject version from the tag into the build

  4. Run tests before upload

  5. Sign when secrets are present (skip signing on forks)

  6. Upload artifacts to the GitHub Release for that tag

  7. Optionally dispatch winget/Homebrew/registry publish jobs

Stamp build info

Pass GITHUB_SHA, tag name, and channel into the compiler or a generated file so About/--version match the release.

Attachments

  • Installers / archives

  • SHA256SUMS

  • SBOM if you generate one

  • Release notes body from changelog

Hardening

  • Pin actions by commit SHA when supply chain matters

  • Separate “build” and “publish” jobs with environment protection for production secrets

  • Never echo signing passwords into logs

Related