Repository navigation
feat: --format sarif, and ship linux/arm64 binaries - #4
Merged
Merged
Conversation
added 2 commits
October 25, 2026 18:29
Releases were manual: bump the version constant, edit CHANGELOG.md, tag, run goreleaser. The v0.13.2 incident (shipped with a stale version constant, fixed by TestFallbackVersionTracksChangelog) is the shape of that risk; this removes the manual steps instead of only detecting them. - release-please (config + manifest + workflow): conventional commits on the default branch keep one open release PR; merging it bumps the annotated version constant, generates the changelog entry, tags, and creates the release - release.yml builds the binaries; release-please DISPATCHES it because a tag created by the workflow token does not trigger the tag-push event (anti-recursion) - the same trap that shipped eight gogogo releases without assets before the bridge was added - the manual tag path stays as an escape hatch, and goreleaser check keeps running in CI Generated changelog entries will use release-please's header style from here on; older entries (Keep a Changelog, hand-written) stay as they are.
SARIF is what GitHub code scanning reads: with `--format sarif` the findings become PR annotations and Security-tab alerts instead of lines in a CI log, which is how a linter reaches a team that never opens the log. The rule id is the diagnostic code (the stable contract), severity maps to SARIF's error/warning/note, and the location carries file, line and column, plus the suggestion in the message. Also removes the goreleaser ignore for linux/arm64: the updater already derives the asset name from GOOS/GOARCH, so the only thing that was missing was the build. - output is deterministic (rules sorted by id) and `results` is `[]`, never null - tests parse the emitted document instead of matching substrings: envelope, tool descriptor, one result per finding with the right level, location and suggestion
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SARIF is what GitHub code scanning reads: with
--format sarifthe findings become PR annotations and Security-tab alerts instead of lines in a CI log — the way a linter reaches a team that never opens the log. The rule id is the diagnostic code (the stable contract), severity maps to SARIF's error/warning/note, and the location carries file, line and column, with the suggestion folded into the message.Also removes the
linux/arm64ignore from goreleaser: the updater already derives the asset name from GOOS/GOARCH, so the only thing missing was the build. linux/arm64 users had no binary and no update path.resultsis[], never null