Skip to main content

​
Release packaging

Release construction is local and non-publishing by default. The stable gate produces four archives, SHA-256 checksums, one SPDX SBOM per archive, a generated Homebrew formula, and a native CLI install smoke test.
GoReleaser runs inside an isolated local clone with a temporary annotated tag, then copies only the resulting dist/ output back. It skips announce and publish pipes. It does not change a source repository ref or create a GitHub release, package, or image. Verify an existing artifact directory independently:
The verifier checks the exact four-platform matrix, archive contents, checksums, SPDX documents, native version, completion generation, and help output. syft is required. The source Homebrew file is a strict template. Candidate construction resolves it from the archive checksums into dist/homebrew/infercrane.rb. Publish that generated formula to the Homebrew tap only after the matching immutable GitHub assets exist. The tag-triggered GitHub workflow creates a draft prerelease, multi-architecture container image, BuildKit SBOM/provenance attestations, immutable image digest artifact, and critical-severity scans. Those external outputs cannot be claimed from local construction and remain pending until the tag is explicitly pushed.

​
Stable release after manual qualification

For a fully qualified release, wait until the consolidated manual report says real_infrastructure: passed and cleanup inventory is verified. An early-project release may instead ship with those limitations explicitly documented when the maintainer accepts that risk. From the clean release commit:
Keep deferred real-provider evidence explicit in the release notes. Upload the generated Homebrew formula only after its URLs resolve and a clean-machine installation passes. The commands intentionally push only main and the stable tag; RC tags remain local unless separately approved for publication.