feat: release pipeline — tag-driven releases with static binaries #7

Merged

synapse merged 1 commit from feat/release-pipe into develop

2026-08-21 16:44:42 +00:00

synapse commented

2026-08-21 16:01:30 +00:00

Owner

Implements the release-pipeline OpenSpec change. Full gate green locally including the new checks.static.

A release is now defined: tag vX.Y.Z → tag/crate-version guard → full CI gate → Forgejo release with five assets: truly static binaries for x86_64 + aarch64 Linux (verified: ldd static, ARM ELF), SHA256SUMS, openapi.json, rendered docs archive. Notes generated from commits since the previous tag. Runs on the same volatile runner as CI.

Notable decision (design D1, veto welcome): reqwest drops its TLS stack entirely — the upstream path is plain HTTP over WireGuard by permanent constraint (stats-api D5), so rustls was dead code; removing it gives a pure-Rust dependency tree, which is why both musl statics link via rust-lld with no cross-gcc and come out at 7.4/7.7 MB. Reversible one-liner if a TLS upstream ever materializes.

Also: --version on the binary (tag equality enforced ⇒ running instances identify their release), rust-overlay input scoped to statics only (the "concrete need" dev-environment's design deferred it for), Releases book page, operator flow in CLAUDE.md.

Asset assembly dry-run performed locally — all five assets build and sha256sum -c verifies.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T5j3dAJVcUjZv9k76sRTt9

Implements the `release-pipeline` OpenSpec change. Full gate green locally including the new `checks.static`. **A release is now defined:** tag `vX.Y.Z` → tag/crate-version guard → full CI gate → Forgejo release with five assets: truly static binaries for x86_64 + aarch64 Linux (verified: `ldd` static, ARM ELF), `SHA256SUMS`, `openapi.json`, rendered docs archive. Notes generated from commits since the previous tag. Runs on the same volatile runner as CI. **Notable decision (design D1, veto welcome):** reqwest drops its TLS stack entirely — the upstream path is plain HTTP over WireGuard by permanent constraint (stats-api D5), so rustls was dead code; removing it gives a pure-Rust dependency tree, which is why both musl statics link via rust-lld with **no cross-gcc** and come out at 7.4/7.7 MB. Reversible one-liner if a TLS upstream ever materializes. Also: `--version` on the binary (tag equality enforced ⇒ running instances identify their release), rust-overlay input scoped to statics only (the "concrete need" dev-environment's design deferred it for), Releases book page, operator flow in CLAUDE.md. Asset assembly dry-run performed locally — all five assets build and `sha256sum -c` verifies. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01T5j3dAJVcUjZv9k76sRTt9

synapse added 1 commit

2026-08-21 16:01:31 +00:00

feat: release pipeline — static binaries, version identity, tag-driven releases

ci / gate (pull_request) Successful in 24s

Details

3a79fb089e

- reqwest drops its TLS stack (upstream is HTTP-over-WireGuard by
  permanent constraint; pure-Rust tree makes musl statics trivial)
- --version prints the crate version; release workflow enforces
  tag == v<version> so binaries identify their release
- rust-overlay input scoped to static builds only: packages.
  static-{x86_64,aarch64}-linux via musl + rust-lld, no cross gcc;
  x86_64 static joins the gate as checks.static
- .forgejo/workflows/release.yml: tag -> guard -> full gate -> 5 assets
  (2 static binaries, SHA256SUMS, openapi.json, docs archive) -> Forgejo
  release with notes from commits since previous tag
- Book: Releases page; CLAUDE.md operator flow; README note

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T5j3dAJVcUjZv9k76sRTt9

synapse merged commit e59f308c14 into develop

2026-08-21 16:44:42 +00:00

synapse deleted branch feat/release-pipe

2026-08-21 16:44:42 +00:00

synapse referenced this pull request from a commit

2026-08-21 16:44:43 +00:00

Merge pull request 'feat: release pipeline — tag-driven releases with static binaries' (#7) from feat/release-pipe into develop