ci(release): publish releases on ermite instead of GitHub

GoReleaser targets git.bnema.dev through templated github_urls, the AUR PKGBUILDs use public ermite URLs, and the GitHub-only provenance attestation is dropped. The release jobs are skipped on the GitHub mirror.

commit: 7a3b92c884e77765c3248ca12c5ad3c70980dcda
author: brice · 12h ago · 2026-10-22 05:42 UTC
parent: ed9eea0
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email
checks: 7/7
refs: maintag: v0.3.1

3 files · +21 -19

M .github/workflows/release.yml +3 -7


@@ -8,7 +8,10 @@ concurrency:
8	8		group: release-${{ github.ref }}
9	9		cancel-in-progress: false
10	10		jobs:
	11	+	# Releases are published by ermite (git.bnema.dev); the GitHub mirror
	12	+	# receives the tags but must not publish a second release or AUR push.
11	13		check:
	14	+	if: github.server_url != 'https://github.com'
12	15		uses: ./.github/workflows/ci.yml
13	16
14	17		release:

@@ -16,8 +19,6 @@ jobs:
16	19		runs-on: ubuntu-latest
17	20		permissions:
18	21		contents: write # create the release
19		-	id-token: write # sign the provenance attestation
20		-	attestations: write
21	22		steps:
22	23		- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
23	24		with:

@@ -33,11 +34,6 @@ jobs:
33	34		args: release --clean
34	35		env:
35	36		GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36		-	- uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
37		-	with:
38		-	subject-path: \|
39		-	dist/*.tar.gz
40		-	dist/checksums.txt
41	37		- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
42	38		with:
43	39		name: aur-bin

   group: release-${{ github.ref }}
   cancel-in-progress: false
 jobs:
+  # Releases are published by ermite (git.bnema.dev); the GitHub mirror
+  # receives the tags but must not publish a second release or AUR push.
   check:
+    if: github.server_url != 'https://github.com'
     uses: ./.github/workflows/ci.yml
   release:
     runs-on: ubuntu-latest
     permissions:
       contents: write     # create the release
-      id-token: write     # sign the provenance attestation
-      attestations: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
-        with:
-          subject-path: |
-            dist/*.tar.gz
-            dist/checksums.txt
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: aur-bin

M .goreleaser.yaml +16 -10

@@ -1,10 +1,18 @@
1		-	# Builds the GitHub release for a pushed v* tag (.github/workflows/release.yml)
	1	+	# Builds the ermite release for a pushed v* tag (.github/workflows/release.yml)
2	2		# and generates the neferbar-bin PKGBUILD. The workflow verifies that PKGBUILD
3	3		# with makepkg before it pushes it to the AUR, so GoReleaser never uploads it.
4	4		version: 2
5	5
6	6		project_name: neferbar
7	7
	8	+	# Releases are published on ermite. In CI the runner sets GITHUB_API_URL and
	9	+	# GITHUB_SERVER_URL to an address the job can reach; the public URLs are the
	10	+	# fallback for a local run.
	11	+	github_urls:
	12	+	api: '{{ or (index .Env "GITHUB_API_URL") "https://git.bnema.dev/-/github/api" }}/'
	13	+	upload: '{{ or (index .Env "GITHUB_API_URL") "https://git.bnema.dev/-/github/api" }}/uploads/'
	14	+	download: '{{ or (index .Env "GITHUB_SERVER_URL") "https://git.bnema.dev" }}/'
	15	+
8	16		before:
9	17		hooks:
10	18		- go mod verify

@@ -48,7 +56,7 @@ git:
48	56
49	57		changelog:
50	58		sort: asc
51		-	use: github
	59	+	use: git
52	60		filters:
53	61		exclude:
54	62		- "^style(\$[^)]+\$)?:"

@@ -97,21 +105,19 @@ release:
97	105		Linux amd64 and arm64. Replace `amd64` with `arm64` on ARM.
98	106
99	107		```sh
100		-	gh release download {{ .Tag }} -R bnema/neferbar -p 'neferbar_{{ .Version }}_linux_amd64.tar.gz' -p checksums.txt
	108	+	curl -fLO https://git.bnema.dev/neferbar/releases/download/{{ .Tag }}/neferbar_{{ .Version }}_linux_amd64.tar.gz
	109	+	curl -fLO https://git.bnema.dev/neferbar/releases/download/{{ .Tag }}/checksums.txt
101	110		sha256sum -c --ignore-missing checksums.txt
102		-	gh attestation verify neferbar_{{ .Version }}_linux_amd64.tar.gz -R bnema/neferbar
103	111		```
104	112
105		-	The archive holds the `neferbar` binary, the example configs and scripts, the README and the license. See the [README](https://github.com/bnema/neferbar#readme) for runtime dependencies.
106		-	footer: \|
107		-	---
108		-
109		-	Full changelog: https://github.com/bnema/neferbar/compare/{{ .PreviousTag }}...{{ .Tag }}
	113	+	The archive holds the `neferbar` binary, the example configs and scripts, the README and the license. See the [README](https://git.bnema.dev/neferbar) for runtime dependencies.
110	114
111	115		aurs:
112	116		- name: neferbar-bin
113	117		ids: [neferbar]
114		-	homepage: https://github.com/bnema/neferbar
	118	+	homepage: https://git.bnema.dev/neferbar
	119	+	# Public URL: github_urls.download is the CI-only relay address.
	120	+	url_template: 'https://git.bnema.dev/neferbar/releases/download/{{ .Tag }}/{{ .ArtifactName }}'
115	121		description: One-cell-high, terminal-style status bar for Wayland, driven by scripts
116	122		maintainers:
117	123		- "bnema <b at bnema dot dev>"

-# Builds the GitHub release for a pushed v* tag (.github/workflows/release.yml)
+# Builds the ermite release for a pushed v* tag (.github/workflows/release.yml)
 # and generates the neferbar-bin PKGBUILD. The workflow verifies that PKGBUILD
 # with makepkg before it pushes it to the AUR, so GoReleaser never uploads it.
 version: 2
 project_name: neferbar
+# Releases are published on ermite. In CI the runner sets GITHUB_API_URL and
+# GITHUB_SERVER_URL to an address the job can reach; the public URLs are the
+# fallback for a local run.
+github_urls:
+  api: '{{ or (index .Env "GITHUB_API_URL") "https://git.bnema.dev/-/github/api" }}/'
+  upload: '{{ or (index .Env "GITHUB_API_URL") "https://git.bnema.dev/-/github/api" }}/uploads/'
+  download: '{{ or (index .Env "GITHUB_SERVER_URL") "https://git.bnema.dev" }}/'
 before:
   hooks:
     - go mod verify
 changelog:
   sort: asc
-  use: github
+  use: git
   filters:
     exclude:
       - "^style(\\([^)]+\\))?:"
     Linux amd64 and arm64. Replace `amd64` with `arm64` on ARM.
     ```sh
-    gh release download {{ .Tag }} -R bnema/neferbar -p 'neferbar_{{ .Version }}_linux_amd64.tar.gz' -p checksums.txt
+    curl -fLO https://git.bnema.dev/neferbar/releases/download/{{ .Tag }}/neferbar_{{ .Version }}_linux_amd64.tar.gz
+    curl -fLO https://git.bnema.dev/neferbar/releases/download/{{ .Tag }}/checksums.txt
     sha256sum -c --ignore-missing checksums.txt
-    gh attestation verify neferbar_{{ .Version }}_linux_amd64.tar.gz -R bnema/neferbar
     ```
-    The archive holds the `neferbar` binary, the example configs and scripts, the README and the license. See the [README](https://github.com/bnema/neferbar#readme) for runtime dependencies.
+    The archive holds the `neferbar` binary, the example configs and scripts, the README and the license. See the [README](https://git.bnema.dev/neferbar) for runtime dependencies.
-  footer: |
-    ---
-    **Full changelog**: https://github.com/bnema/neferbar/compare/{{ .PreviousTag }}...{{ .Tag }}
 aurs:
   - name: neferbar-bin
     ids: [neferbar]
-    homepage: https://github.com/bnema/neferbar
+    homepage: https://git.bnema.dev/neferbar
+    # Public URL: github_urls.download is the CI-only relay address.
+    url_template: 'https://git.bnema.dev/neferbar/releases/download/{{ .Tag }}/{{ .ArtifactName }}'
     description: One-cell-high, terminal-style status bar for Wayland, driven by scripts
     maintainers:
       - "bnema <b at bnema dot dev>"

M packaging/aur/neferbar-git/PKGBUILD +2 -2


@@ -6,7 +6,7 @@ pkgver=0.0.0.r0.g0000000
6	6		pkgrel=1
7	7		pkgdesc='One-cell-high, terminal-style status bar for Wayland, driven by scripts (git version)'
8	8		arch=('x86_64' 'aarch64')
9		-	url='https://github.com/bnema/neferbar'
	9	+	url='https://git.bnema.dev/neferbar'
10	10		license=('MIT')
11	11		# Loaded at runtime (purego, no cgo): not seen by makepkg's library scan.
12	12		# fontconfig provides fc-match, which finds the font files.

@@ -15,7 +15,7 @@ makedepends=('go>=2:1.27' 'git')
15	15		optdepends=('ttf-jetbrains-mono-nerd: default font, with the icons modules print')
16	16		provides=('neferbar')
17	17		conflicts=('neferbar' 'neferbar-bin')
18		-	source=('git+https://github.com/bnema/neferbar.git')
	18	+	source=('git+https://git.bnema.dev/neferbar.git')
19	19		sha256sums=('SKIP')
20	20
21	21		pkgver() {


@@ -6,7 +6,7 @@ pkgver=0.0.0.r0.g0000000
6		pkgrel=1	6		pkgrel=1
7		pkgdesc='One-cell-high, terminal-style status bar for Wayland, driven by scripts (git version)'	7		pkgdesc='One-cell-high, terminal-style status bar for Wayland, driven by scripts (git version)'
8		arch=('x86_64' 'aarch64')	8		arch=('x86_64' 'aarch64')
9	-	url='https://github.com/bnema/neferbar'	9	+	url='https://git.bnema.dev/neferbar'
10		license=('MIT')	10		license=('MIT')
11		# Loaded at runtime (purego, no cgo): not seen by makepkg's library scan.	11		# Loaded at runtime (purego, no cgo): not seen by makepkg's library scan.
12		# fontconfig provides fc-match, which finds the font files.	12		# fontconfig provides fc-match, which finds the font files.

@@ -15,7 +15,7 @@ makedepends=('go>=2:1.27' 'git')
15		optdepends=('ttf-jetbrains-mono-nerd: default font, with the icons modules print')	15		optdepends=('ttf-jetbrains-mono-nerd: default font, with the icons modules print')
16		provides=('neferbar')	16		provides=('neferbar')
17		conflicts=('neferbar' 'neferbar-bin')	17		conflicts=('neferbar' 'neferbar-bin')
18	-	source=('git+https://github.com/bnema/neferbar.git')	18	+	source=('git+https://git.bnema.dev/neferbar.git')
19		sha256sums=('SKIP')	19		sha256sums=('SKIP')
20			20
21		pkgver() {	21		pkgver() {