From db792567248510f8712aedb140e0e203ad913c3b Mon Sep 17 00:00:00 2001 From: "Tj (bougyman) Vanderpoel" Date: Sun, 9 Aug 2026 16:53:27 -0400 Subject: [PATCH 1/2] ci: verify required release targets built and publish SHA256SUMS No Homebrew tap exists yet (CRY-37), so the GitHub Release binaries are the primary install path for a lot of users right now, not a fallback. Two real gaps: `mix release lc` builds all 3 Burrito targets in one invocation and Burrito builds each independently, so one target could silently fail without failing the whole build - the release could ship missing a binary with no CI signal. And nothing let a downloader verify a binary wasn't corrupted or tampered with in transit. Explicitly verify lc_linux_x86_64 and lc_macos_aarch64 exist post-build, failing loudly (::error::) if either is missing - the guaranteed floor. Windows keeps building for free but isn't asserted on. Generate a SHA256SUMS file covering every artifact that did build, uploaded alongside the binaries. Readme.adoc documents verification on both platforms - shasum -a 256 -c - on macOS (no sha256sum on stock macOS), sha256sum -c - on Linux. Closes #16. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/burrito-release.yaml | 27 +++++++++++++++++++++++++- Readme.adoc | 9 ++++++--- 2 files changed, 32 insertions(+), 4 deletions(-) diff --git a/.github/workflows/burrito-release.yaml b/.github/workflows/burrito-release.yaml index 5b9cd90..f815e8b 100644 --- a/.github/workflows/burrito-release.yaml +++ b/.github/workflows/burrito-release.yaml @@ -56,7 +56,32 @@ jobs: name: Build all Burrito targets run: MIX_ENV=prod mix release lc - - name: Upload binaries to the GitHub release + # `mix release lc`'s exit code alone doesn't guarantee every target + # actually produced a binary - Burrito builds each target + # independently, so one target failing partway through wouldn't + # necessarily fail the whole `mix release` invocation. Not everyone + # installing this uses Homebrew (no tap exists yet anyway - see + # #14/CRY-37), so these binaries are the primary install path for + # a lot of users; silently shipping a release missing one of them + # is worse than failing loudly here. + name: Verify the required targets actually built + run: | + missing=0 + for target in lc_linux_x86_64 lc_macos_aarch64 + do + if [ ! -f "burrito_out/$target" ] + then + printf '::error::missing required release artifact: %s\n' "$target" + missing=1 + fi + done + [ "$missing" -eq 0 ] + - + name: Generate checksums for every built artifact + run: sha256sum * > SHA256SUMS + working-directory: app/burrito_out + - + name: Upload binaries and checksums to the GitHub release env: GH_TOKEN: ${{ github.token }} run: gh release upload "${{ inputs.tag_name }}" app/burrito_out/* --clobber diff --git a/Readme.adoc b/Readme.adoc index 564a5e5..c6fc266 100644 --- a/Readme.adoc +++ b/Readme.adoc @@ -44,10 +44,13 @@ standalone executables with no Erlang/Elixir install required. [source,sh] ---- -$ curl -sLo lc https://github.com/rubyists/linear-cli-ex/releases/latest/download/lc_macos_aarch64 -$ chmod +x lc -$ sudo mv lc /usr/local/bin/lc +$ curl -sLO https://github.com/rubyists/linear-cli-ex/releases/latest/download/lc_macos_aarch64 +$ curl -sLo SHA256SUMS https://github.com/rubyists/linear-cli-ex/releases/latest/download/SHA256SUMS +$ grep lc_macos_aarch64 SHA256SUMS | shasum -a 256 -c - <1> +$ chmod +x lc_macos_aarch64 +$ sudo mv lc_macos_aarch64 /usr/local/bin/lc ---- +<1> Every release also publishes a `SHA256SUMS` file alongside the binaries - verify your download matches (by its original filename, before renaming/moving it) before running it. macOS ships `shasum -a 256`, not `sha256sum` - on Linux, use `sha256sum -c -` instead. NOTE: A Homebrew tap is planned but not yet available. From d569a264254e738466ea54b4d29642f0179e6b52 Mon Sep 17 00:00:00 2001 From: "Tj (bougyman) Vanderpoel" Date: Sun, 9 Aug 2026 17:02:07 -0400 Subject: [PATCH 2/2] fix(docs): guard the checksum verification example against a grep miss A grep miss piping empty input into the checker isn't safe to skip - sha256sum -c - (the Linux equivalent) exits 0 on empty input, so a typo'd filename would silently "pass" without checking anything at all. Guard with grep -q ... && first. Also trims the accompanying footnote back down to the platform-command difference alone - the rationale belongs here in the commit message, not as an implementation essay in the Readme itself. Co-Authored-By: Claude Sonnet 5 --- Readme.adoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Readme.adoc b/Readme.adoc index c6fc266..ac84a31 100644 --- a/Readme.adoc +++ b/Readme.adoc @@ -46,11 +46,11 @@ standalone executables with no Erlang/Elixir install required. ---- $ curl -sLO https://github.com/rubyists/linear-cli-ex/releases/latest/download/lc_macos_aarch64 $ curl -sLo SHA256SUMS https://github.com/rubyists/linear-cli-ex/releases/latest/download/SHA256SUMS -$ grep lc_macos_aarch64 SHA256SUMS | shasum -a 256 -c - <1> +$ grep -q lc_macos_aarch64 SHA256SUMS && grep lc_macos_aarch64 SHA256SUMS | shasum -a 256 -c - <1> $ chmod +x lc_macos_aarch64 $ sudo mv lc_macos_aarch64 /usr/local/bin/lc ---- -<1> Every release also publishes a `SHA256SUMS` file alongside the binaries - verify your download matches (by its original filename, before renaming/moving it) before running it. macOS ships `shasum -a 256`, not `sha256sum` - on Linux, use `sha256sum -c -` instead. +<1> Linux: `sha256sum -c -` instead of `shasum -a 256 -c -`. NOTE: A Homebrew tap is planned but not yet available.