v0.0.1 candidate

.github/workflows/develop.yml

@@ -0,0 +1,173 @@
+name: Develop Build
+
+on:
+  push:
+    branches:
+      - develop
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build QC artifacts
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run GoReleaser (all platforms, unsigned)
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          docker run --rm \
+            -v "${PWD}:/workspace" \
+            -w /workspace \
+            -e GITHUB_TOKEN \
+            ghcr.io/goreleaser/goreleaser-cross:v1.25-v2.12.7 \
+            release --snapshot --config .goreleaser/config-qc.yaml --clean --parallelism 2
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: qc-artifacts-${{ github.run_number }}
+          if-no-files-found: error
+          path: |
+            dist/*.tar.gz
+            dist/*.zip
+            dist/checksums.txt
+            dist/artifacts.json
+            dist/metadata.json
+
+  sign-macos:
+    name: Sign macOS artifacts
+    runs-on: macos-latest
+    needs: build
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+
+      - name: Check for Apple signing secrets
+        id: secrets_check
+        env:
+          APPLE_CERT_P12: ${{ secrets.APPLE_CERT_P12 }}
+        run: |
+          if [ -n "$APPLE_CERT_P12" ]; then
+            echo "has_signing_cert=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_signing_cert=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::APPLE_CERT_P12 not configured — skipping Apple code signing."
+          fi
+
+      - name: Import Apple certificate
+        if: ${{ steps.secrets_check.outputs.has_signing_cert == 'true' }}
+        env:
+          APPLE_CERT_P12: ${{ secrets.APPLE_CERT_P12 }}
+          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          set -e
+          for var_name in APPLE_CERT_PASSWORD KEYCHAIN_PASSWORD; do
+            if [ -z "${!var_name}" ]; then
+              echo "::error::$var_name is required when APPLE_CERT_P12 is configured."
+              exit 1
+            fi
+          done
+
+          printf '%s' "$APPLE_CERT_P12" | base64 -D > cert.p12
+
+          KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain-db"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security import cert.p12 -k "$KEYCHAIN_PATH" -P "$APPLE_CERT_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"' | xargs)
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: qc-artifacts-${{ github.run_number }}
+          path: dist
+
+      - name: Sign macOS artifacts
+        if: ${{ steps.secrets_check.outputs.has_signing_cert == 'true' }}
+        env:
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          KEYCHAIN_PATH: ${{ runner.temp }}/build.keychain-db
+        run: |
+          set -e
+          if [ -z "$APPLE_SIGNING_IDENTITY" ]; then
+            echo "::error::APPLE_SIGNING_IDENTITY is required for signing."
+            exit 1
+          fi
+          if [ ! -f dist/checksums.txt ]; then
+            echo "::error::dist/checksums.txt not found."
+            exit 1
+          fi
+
+          for archive in dist/*-darwin-*.tar.gz; do
+            [ -f "$archive" ] || continue
+            tmpdir="$(mktemp -d)"
+            orig_members=$(tar -tzf "$archive")
+            tar -xzf "$archive" -C "$tmpdir"
+
+            while IFS= read -r -d '' bin; do
+              codesign --force --options runtime --timestamp \
+                --keychain "$KEYCHAIN_PATH" \
+                --sign "$APPLE_SIGNING_IDENTITY" "$bin"
+              codesign --verify --deep --strict "$bin"
+            done < <(find "$tmpdir" -type f -perm -111 -print0)
+
+            # shellcheck disable=SC2086
+            tar -czf "${archive}.signed" -C "$tmpdir" $orig_members
+            mv "${archive}.signed" "$archive"
+            rm -rf "$tmpdir"
+
+            filename="$(basename "$archive")"
+            sha="$(shasum -a 256 "$archive" | awk '{print $1}')"
+            grep -v "  $filename\$" dist/checksums.txt > dist/checksums.new || true
+            printf "%s  %s\n" "$sha" "$filename" >> dist/checksums.new
+            mv dist/checksums.new dist/checksums.txt
+
+            PATCH_NAME="$filename" PATCH_SHA="$sha" python3 << 'PYEOF'
+          import json, os
+          data = json.load(open('dist/artifacts.json'))
+          name = os.environ['PATCH_NAME']
+          checksum = os.environ['PATCH_SHA']
+          for a in data:
+              if a.get('name') == name:
+                  a.setdefault('extra', {})['Checksum'] = 'sha256:' + checksum
+          with open('dist/artifacts.json', 'w') as f:
+              json.dump(data, f, indent=2)
+          PYEOF
+          done
+
+      - name: Upload signed macOS artifacts
+        if: ${{ steps.secrets_check.outputs.has_signing_cert == 'true' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: qc-artifacts-macos-signed-${{ github.run_number }}
+          if-no-files-found: error
+          path: |
+            dist/*-darwin-amd64.tar.gz
+            dist/*-darwin-arm64.tar.gz
+            dist/checksums.txt
+
+      - name: Clean up keychain and cert
+        if: always()
+        run: |
+          security delete-keychain "$RUNNER_TEMP/build.keychain-db" 2>/dev/null || true
+          rm -f cert.p12

.github/workflows/quality.yml

@@ -0,0 +1,32 @@
+name: Quality Checks
+
+on: pull_request
+
+permissions:
+  contents: read
+  issues: read
+  checks: write
+  pull-requests: write
+
+jobs:
+  test:
+    name: Verify build and run unit tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Download modules
+        run: go mod download
+
+      - name: Verify build
+        run: go build
+
+      - name: Run tests
+        run: go test ./...