This repository defines the reusable workflows and repository contract that Meigma uses to build, sign, attest, and publish Go binaries through GitHub Releases and multi-architecture OCI images through GHCR. It also builds and publishes release-cli, which the Go producer uses to validate staged release artifacts. The repository's tagged release builds the CLI from its own source and supplies that binary to the producer workflow.
- Configure GitHub releases
- Configure OCI image publication
- Rehearse and recover GitHub releases
- Upgrade GitHub release workflows
release-clicontract reference- GitHub release contract reference
- OCI image contract reference
- Copyable Go release example
Consumer repositories call the reusable workflows at one full commit SHA. FULL_SHA is the placeholder for the released commit and will be replaced when this program's final pull request lands; the copyable example remains pinned to the last released revision until then.