4 Commits

Author SHA1 Message Date
anonpenguin23
3676b000a6 chore: adopt DeBros DAO baseline rules + release 0.122.11
Standardization batch — no application code changes. Pulls in the
DeBros DAO baseline rules (v0.1.0, sha 51ce3f8) for supply-chain
defense and toolchain pinning.

Files added:
- DEBROS.md + debros.json — adopted-rules manifest
- .debros/compliance/{go,javascript-typescript,zig}.md — per-language
  compliance docs
- .github/workflows/security.yml — auto-detecting security CI
  (npm audit + go vulncheck), runs on main + weekly cron
- renovate.json — 30-day dependency cooldown, no auto-merge,
  vulnerability alerts bypass cooldown
- .nvmrc — pin Node 20.18.0
- vault/.zigversion — pin Zig 0.14.0
- sdk/.npmrc, website/.npmrc — supply-chain hardening
  (ignore-scripts, strict-peer-dependencies, save-exact, etc.)

Files modified:
- core/go.mod, os/agent/go.mod, website/invest-api/go.mod —
  add `toolchain go1.24.6` directive for reproducible builds
- VERSION + sdk/package.json — bump to 0.122.11
2026-05-12 11:10:10 +03:00
anonpenguin23
d990d0d6b3 release: 0.122.10 2026-05-12 10:14:53 +03:00
anonpenguin23
58d541d9ee ci: goreleaser v2 hooks need string form, bump to 0.122.9
GoReleaser v2.15.4 rejects the {cmd: ..., dir: ...} map syntax for
before.hooks even though v2 docs show it. Reverting to the simple
string form `go -C core mod tidy` that worked in v1.
2026-05-12 09:54:58 +03:00
anonpenguin23
8e4d11a6ce ci: single VERSION file, version guards, goreleaser v2, CI on push
Workflow hardening based on the four-cycle release-debugging session:

Centralized versioning
- Add /VERSION at repo root as single source of truth.
- core/Makefile reads VERSION via `$(shell cat ../VERSION)`.
- Add `make bump VER=X.Y.Z` target that updates /VERSION and syncs
  sdk/package.json in one shot.

Version mismatch guards
- All three release workflows (release.yaml, release-apt.yml,
  publish-sdk.yml) now verify the release tag matches /VERSION at the
  very first step. Stale-VERSION releases fail fast with a clear hint
  to run `make bump`.

GoReleaser v2 migration
- Upgrade goreleaser-action v5 -> v6 (pinned `~> v2`).
- Add `version: 2` to .goreleaser.yaml.
- Migrate to v2 syntax: `archives.format` -> `formats: [...]`,
  `brews.folder` -> `directory`, `snapshot.name_template` ->
  `version_template`, `builds`-style references replaced with `ids:`.
- `before.hooks` can use map syntax again (v2 supports it).

Homebrew tap on stable only
- `brews.skip_upload` is now `'{{ if .Prerelease }}true{{ else }}false{{ end }}'`.
- Stops nightly releases from polluting the tap and from hitting 401
  on stale HOMEBREW_TAP_TOKEN. Stable main releases still publish.

CI on every push
- New ci.yml runs `go vet` + `go test -race` on the core module and
  typecheck/build/unit-tests on the SDK for every push to main/nightly
  and every PR. version-sanity job warns when /VERSION and
  sdk/package.json drift.

Version bump for next pipeline test
- /VERSION: 0.122.8
- sdk/package.json: 0.122.8
2026-05-12 09:49:33 +03:00