Release packaging

Build and verify release archives, checksums, SPDX SBOMs, Homebrew formulae, and container provenance without publishing.

Release packaging

Release construction is local and non-publishing by default. The stable gate produces four archives, SHA-256 checksums, one SPDX SBOM per archive, a generated Homebrew formula, and a native CLI install smoke test.

make release-artifacts RELEASE_TAG=v2.0.0

GoReleaser runs inside an isolated local clone with a temporary annotated tag, then copies only the resulting dist/ output back. It skips announce and publish pipes. It does not change a source repository ref or create a GitHub release, package, or image.

Verify an existing artifact directory independently:

./scripts/verify-release-artifacts.sh dist v2.0.0

The verifier checks the exact four-platform matrix, archive contents, checksums, SPDX documents, native version, completion generation, and help output. syft is required.

The source Homebrew file is a strict template. Candidate construction resolves it from the archive checksums into dist/homebrew/infercrane.rb. Publish that generated formula to the Homebrew tap only after the matching immutable GitHub assets exist.

The tag-triggered GitHub workflow creates a draft prerelease, multi-architecture container image, BuildKit SBOM/provenance attestations, immutable image digest artifact, and critical-severity scans. Those external outputs cannot be claimed from local construction and remain pending until the tag is explicitly pushed.

Stable release after manual qualification

For a fully qualified release, wait until the consolidated manual report says real_infrastructure: passed and cleanup inventory is verified. An early-project release may instead ship with those limitations explicitly documented when the maintainer accepts that risk. From the clean release commit:

make release-artifacts RELEASE_TAG=v2.0.0
git tag -a v2.0.0 -m "InferCrane v2.0.0"
git push origin main
git push origin v2.0.0
gh release create v2.0.0 \
  dist/infercrane_2.0.0_*.tar.gz \
  dist/infercrane_2.0.0_*.tar.gz.sbom.json \
  dist/checksums.txt \
  --title "InferCrane v2.0.0" \
  --notes-file docs/release-notes-v2.0.0.md

Keep deferred real-provider evidence explicit in the release notes. Upload the generated Homebrew formula only after its URLs resolve and a clean-machine installation passes. The commands intentionally push only main and the stable tag; RC tags remain local unless separately approved for publication.