From 4f8da2ca7a9847901c6f4dc66f2dd5ec9a62ce08 Mon Sep 17 00:00:00 2001
From: nsportsman <nathan.sportsman@praetorian.com>
Date: Sat, 30 May 2026 09:31:20 -0500
Subject: [PATCH] feat: add changelog grouping and supply chain hooks to
 goreleaser config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Before hooks: go mod tidy -diff (fails fast if modules dirty without
  modifying files — safe for release time) + go mod verify (validates
  cached dep checksums against go.sum for supply chain integrity)
- Changelog: grouped by conventional commit type using GitHub API for
  richer data (PR links, author handles). Groups: Breaking Changes →
  Features → Bug Fixes → Other Changes. Scope regex supports hyphens.
  Breaking regex handles GoReleaser's SHA-prefixed entry format.
  docs/test/chore commits excluded via filters.

Incorporates 3 rounds of multi-model review feedback (Claude, Gemini,
Codex) on regex correctness, SHA prefix handling, and tidy -diff safety.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .goreleaser.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index a85b95a..995da95 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -1,5 +1,10 @@
 version: 2
 
+before:
+  hooks:
+    - go mod tidy -diff
+    - go mod verify
+
 builds:
   - main: ./cmd/pius
     binary: pius
@@ -26,7 +31,20 @@ checksum:
   name_template: "checksums.txt"
 
 changelog:
+  use: github
   sort: asc
+  groups:
+    - title: "Breaking Changes"
+      regexp: '^.*?[a-zA-Z]+(\([^)]+\))?!:.+$'
+      order: 0
+    - title: "Features"
+      regexp: '^.*?feat(\([^)]+\))?!?:.+$'
+      order: 1
+    - title: "Bug Fixes"
+      regexp: '^.*?fix(\([^)]+\))?!?:.+$'
+      order: 2
+    - title: "Other Changes"
+      order: 999
   filters:
     exclude:
       - "^docs:"