> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infercrane.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Release packaging

> Build and verify release archives, checksums, SPDX SBOMs, Homebrew formulae, and container provenance without publishing.

# Release packaging

Release construction is local and non-publishing by default. The stable gate produces four
archives, SHA-256 checksums, one SPDX SBOM per archive, a generated Homebrew formula, and a native CLI
install smoke test.

```bash theme={"theme":"css-variables"}
make release-artifacts RELEASE_TAG=v2.0.0
```

GoReleaser runs inside an isolated local clone with a temporary annotated tag, then copies only the
resulting `dist/` output back. It skips announce and publish pipes. It does not change a source
repository ref or create a GitHub release, package, or image.

Verify an existing artifact directory independently:

```bash theme={"theme":"css-variables"}
./scripts/verify-release-artifacts.sh dist v2.0.0
```

The verifier checks the exact four-platform matrix, archive contents, checksums, SPDX documents,
native `version`, completion generation, and help output. `syft` is required.

The source Homebrew file is a strict template. Candidate construction resolves it from the archive
checksums into `dist/homebrew/infercrane.rb`. Publish that generated formula to the Homebrew tap only
after the matching immutable GitHub assets exist.

The tag-triggered GitHub workflow creates a draft prerelease, multi-architecture container image,
BuildKit SBOM/provenance attestations, immutable image digest artifact, and critical-severity scans.
Those external outputs cannot be claimed from local construction and remain pending until the tag is
explicitly pushed.

## Stable release after manual qualification

For a fully qualified release, wait until the consolidated manual report says
`real_infrastructure: passed` and cleanup inventory is verified. An early-project release may instead
ship with those limitations explicitly documented when the maintainer accepts that risk. From the
clean release commit:

```bash theme={"theme":"css-variables"}
make release-artifacts RELEASE_TAG=v2.0.0
git tag -a v2.0.0 -m "InferCrane v2.0.0"
git push origin main
git push origin v2.0.0
gh release create v2.0.0 \
  dist/infercrane_2.0.0_*.tar.gz \
  dist/infercrane_2.0.0_*.tar.gz.sbom.json \
  dist/checksums.txt \
  --title "InferCrane v2.0.0" \
  --notes-file docs/release-notes-v2.0.0.md
```

Keep deferred real-provider evidence explicit in the release notes. Upload the generated Homebrew formula only after its URLs resolve and
a clean-machine installation passes. The commands intentionally push only `main` and the stable
tag; RC tags remain local unless separately approved for publication.