docs: update actions-source-policy for softprops removal and release changes

- Remove softprops/action-gh-release from allowlist (replaced by gh CLI) - Update Beta Release trigger description (daily schedule + dispatch) - Add changelog entry for release pipeline overhaul Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
fix(ci): pin release tag to triggering commit via --target GITHUB_SHA
2026-03-07 18:38:15 -05:00 · 2026-03-07 18:12:57 -05:00 · 2026-03-07 17:53:05 -05:00 · 2026-03-07 17:52:40 -05:00 · 2026-03-07 17:44:43 -05:00 · 2026-03-07 17:42:40 -05:00
3 changed files with 51 additions and 24 deletions
--- a/.github/workflows/promote-release.yml
+++ b/.github/workflows/promote-release.yml
@ -75,10 +75,21 @@ jobs:
            cross_compiler: gcc-aarch64-linux-gnu
            linker_env: CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER
            linker: aarch64-linux-gnu-gcc
+          - os: ubuntu-latest
+            target: armv7-unknown-linux-gnueabihf
+            artifact: zeroclaw
+            ext: tar.gz
+            cross_compiler: gcc-arm-linux-gnueabihf
+            linker_env: CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER
+            linker: arm-linux-gnueabihf-gcc
          - os: macos-14
            target: aarch64-apple-darwin
            artifact: zeroclaw
            ext: tar.gz
+          - os: macos-14
+            target: x86_64-apple-darwin
+            artifact: zeroclaw
+            ext: tar.gz
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: zeroclaw.exe
@ -142,16 +153,16 @@ jobs:
          cat SHA256SUMS

      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ needs.validate.outputs.tag }}
-          name: ${{ needs.validate.outputs.tag }}
-          prerelease: false
-          generate_release_notes: true
-          files: |
-            artifacts/**/*
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ needs.validate.outputs.tag }}" \
+            --repo "${{ github.repository }}" \
+            --target "$GITHUB_SHA" \
+            --title "${{ needs.validate.outputs.tag }}" \
+            --latest \
+            --generate-notes \
+            artifacts/*/*.tar.gz artifacts/*/*.zip artifacts/SHA256SUMS

  docker:
    name: Push Docker Image
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -1,8 +1,9 @@
-name: Beta Release
+name: Daily Beta Release

 on:
-  push:
-    branches: [master]
+  schedule:
+    - cron: '0 8 * * *'  # Daily at 08:00 UTC
+  workflow_dispatch: {}

 concurrency:
  group: release
@ -19,6 +20,7 @@ env:

 jobs:
  version:
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
    name: Resolve Version
    runs-on: ubuntu-latest
    outputs:
@ -57,10 +59,21 @@ jobs:
            cross_compiler: gcc-aarch64-linux-gnu
            linker_env: CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER
            linker: aarch64-linux-gnu-gcc
+          - os: ubuntu-latest
+            target: armv7-unknown-linux-gnueabihf
+            artifact: zeroclaw
+            ext: tar.gz
+            cross_compiler: gcc-arm-linux-gnueabihf
+            linker_env: CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER
+            linker: arm-linux-gnueabihf-gcc
          - os: macos-14
            target: aarch64-apple-darwin
            artifact: zeroclaw
            ext: tar.gz
+          - os: macos-14
+            target: x86_64-apple-darwin
+            artifact: zeroclaw
+            ext: tar.gz
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact: zeroclaw.exe
@ -124,16 +137,16 @@ jobs:
          cat SHA256SUMS

      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ needs.version.outputs.tag }}
-          name: ${{ needs.version.outputs.tag }}
-          prerelease: true
-          generate_release_notes: true
-          files: |
-            artifacts/**/*
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ needs.version.outputs.tag }}" \
+            --repo "${{ github.repository }}" \
+            --target "$GITHUB_SHA" \
+            --title "${{ needs.version.outputs.tag }}" \
+            --prerelease \
+            --generate-notes \
+            artifacts/*/*.tar.gz artifacts/*/*.zip artifacts/SHA256SUMS

  docker:
    name: Push Docker Image
--- a/docs/actions-source-policy.md
+++ b/docs/actions-source-policy.md
@ -16,7 +16,6 @@ Selected allowlist (all actions currently used across CI, Beta Release, and Prom
 | `actions/download-artifact@v4` | release, promote-release | Download build artifacts for packaging |
 | `dtolnay/rust-toolchain@stable` | All workflows | Install Rust toolchain (1.92.0) |
 | `Swatinem/rust-cache@v2` | All workflows | Cargo build/dependency caching |
-| `softprops/action-gh-release@v2` | release, promote-release | Create GitHub Releases |
 | `docker/setup-buildx-action@v3` | release, promote-release | Docker Buildx setup |
 | `docker/login-action@v3` | release, promote-release | GHCR authentication |
 | `docker/build-push-action@v6` | release, promote-release | Multi-platform Docker image build and push |
@ -26,7 +25,6 @@ Equivalent allowlist patterns:
 - `actions/*`
 - `dtolnay/rust-toolchain@*`
 - `Swatinem/rust-cache@*`
- `softprops/action-gh-release@*`
 - `docker/*`

 ## Workflows
@ -34,7 +32,7 @@ Equivalent allowlist patterns:
 | Workflow | File | Trigger |
 |----------|------|---------|
 | CI | `.github/workflows/ci.yml` | Pull requests to `master` |
-| Beta Release | `.github/workflows/release.yml` | Push to `master` |
+| Daily Beta Release | `.github/workflows/release.yml` | Daily schedule (08:00 UTC) + manual `workflow_dispatch` |
 | Promote Release | `.github/workflows/promote-release.yml` | Manual `workflow_dispatch` |

 ## Change Control
@ -68,6 +66,11 @@ gh api repos/zeroclaw-labs/zeroclaw/actions/permissions/selected-actions
    - Retained: `actions/*`, `dtolnay/rust-toolchain@*`, `softprops/action-gh-release@*`, `docker/*`
 - 2026-03-05: CI build optimization — added mold linker, cargo-nextest, CARGO_INCREMENTAL=0
    - sccache removed due to fragile GHA cache backend causing build failures
+- 2026-03-07: Release pipeline overhaul
+    - Removed: `softprops/action-gh-release@*` (replaced with built-in `gh` CLI)
+    - Beta trigger changed from push-on-master to daily schedule + workflow_dispatch
+    - Added default-branch guard on beta workflow_dispatch
+    - Added build targets: `armv7-unknown-linux-gnueabihf`, `x86_64-apple-darwin` (cross-compiled from macos-14)

 ## Rollback
Author	SHA1	Message	Date
jordanthejet	5dfd0a5e2b	docs: update actions-source-policy for softprops removal and release changes - Remove softprops/action-gh-release from allowlist (replaced by gh CLI) - Update Beta Release trigger description (daily schedule + dispatch) - Add changelog entry for release pipeline overhaul Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 18:38:15 -05:00
jordanthejet	2896875331	fix(ci): pin release tag to triggering commit via --target GITHUB_SHA Without --target, gh release create tags the latest commit on the default branch, which may differ from the commit that built the artifacts. Pin to $GITHUB_SHA so the tag always matches the built ref. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 18:12:57 -05:00
jordanthejet	a2d5672e72	fix(ci): correct artifact glob paths for release upload SHA256SUMS is generated at artifacts/SHA256SUMS (not nested in a subdirectory), so use artifacts/SHA256SUMS instead of artifacts/*/SHA256SUMS. Also use artifacts// single-level glob to match the download-artifact directory structure. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 17:53:05 -05:00
jordanthejet	bb7314bc37	fix(ci): add default-branch guard to beta release workflow_dispatch Prevent manual beta releases from non-default branches by gating the version job on github.ref matching the default branch. Off-branch dispatches now fail closed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 17:52:40 -05:00
JordanTheJet	b59e3ae6d1	Merge branch 'master' into fix/release-pipeline	2026-03-07 17:44:43 -05:00
jordanthejet	1f8934c4b4	feat(ci): add armv7 Linux build target to release pipelines Add armv7-unknown-linux-gnueabihf to the build matrix for both beta and stable release workflows, cross-compiled from ubuntu-latest using gcc-arm-linux-gnueabihf. Full release target matrix: - Linux: x86_64, aarch64, armv7 - macOS: x86_64, aarch64 - Windows: x86_64 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 17:42:40 -05:00
jordanthejet	ace9f19b11	fix(ci): overhaul release pipeline — daily betas, gh CLI publish, x86_64 macOS cross-compile - Switch beta releases from per-merge to daily schedule (08:00 UTC) plus manual workflow_dispatch to reduce release spam - Replace softprops/action-gh-release with gh CLI to fix the "Finalizing release" retry failure that left releases as drafts - Beta releases use --prerelease; stable releases use --latest so the stable version stays prominently badged on the releases page - Add x86_64-apple-darwin target back via cross-compile from macos-14 (ARM runner), replacing the deprecated macos-13 Intel runner Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 11:46:37 -05:00