From d6acb270b6d04d4b7ee1d53ae79467d9d4dbff63 Mon Sep 17 00:00:00 2001 From: Lars Schneider Date: Thu, 12 Nov 2026 12:00:36 +0000 Subject: [PATCH 1/6] Disable cgo for release binaries Cross-compiled release targets already disable cgo implicitly, but the native host target (linux/amd64 on ubuntu-latest) defaults to CGO_ENABLED=1 and links against GLIBC_2.34, which fails on older systems like Ubuntu 20.04 (GLIBC_2.31). Force CGO_ENABLED=0 for all release targets so every archive ships a static binary. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5946d63-5054-4db7-8484-2db48414dc6e --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index ff80eaf..5a806b0 100644 --- a/Makefile +++ b/Makefile @@ -41,7 +41,7 @@ define PLATFORM_template = .PHONY: bin/git-sizer-$(1)-$(2)$(3) bin/git-sizer-$(1)-$(2)$(3): mkdir -p bin - GOOS=$(1) GOARCH=$(2) $$(GO) build $$(GOFLAGS) -ldflags "-X main.ReleaseVersion=$$(VERSION)" -o $$@ . + CGO_ENABLED=0 GOOS=$(1) GOARCH=$(2) $$(GO) build $$(GOFLAGS) -ldflags "-X main.ReleaseVersion=$$(VERSION)" -o $$@ . common-platforms: bin/git-sizer-$(1)-$(2)$(3) # Note that releases don't include code from vendor (they're only used From a6b4c6b49d4dd723db932c20ec5fc6f368954b83 Mon Sep 17 00:00:00 2001 From: Lars Schneider Date: Thu, 12 Nov 2026 12:00:36 +0000 Subject: [PATCH 2/6] Strip "v" prefix from release VERSION GITHUB_REF_NAME includes the tag's leading "v" (e.g. "v1.6.0"), whereas Makefile expects a bare version ("1.6.0"). Strip the prefix so archive names and "--version" output match prior releases (v1.0.0-v1.5.0) and downstream packaging URLs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5946d63-5054-4db7-8484-2db48414dc6e --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b157e88..c6ce177 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,7 +25,7 @@ jobs: - name: Build releases run: | - make releases VERSION=$GITHUB_REF_NAME + make releases VERSION="${GITHUB_REF_NAME#v}" - name: Release uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 From 7a1f023ca577b824acf43c3356ed8ede10283ff1 Mon Sep 17 00:00:00 2001 From: Lars Schneider Date: Thu, 12 Nov 2026 12:00:36 +0000 Subject: [PATCH 3/6] Update vendored Go scripts to 1.27.3 Raise the fallback vendored Go version from 1.21.3 to 1.27.3 (and add linux/arm64 checksums) to pick up Go stdlib security fixes such as CVE-2026-111943, while still accepting installed Go 1.26.10+. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5946d63-5054-4db7-8484-2db48414dc6e --- script/ensure-go-installed.sh | 13 +++++++++---- script/install-vendored-go | 12 ++++++++---- 2 files changed, 17 insertions(+), 8 deletions(-) diff --git a/script/ensure-go-installed.sh b/script/ensure-go-installed.sh index 1e301fd..7a760f1 100644 --- a/script/ensure-go-installed.sh +++ b/script/ensure-go-installed.sh @@ -4,17 +4,22 @@ if [ -z "$ROOTDIR" ]; then echo 1>&2 'ensure-go-installed.sh invoked without ROOTDIR set!' fi -# Is go installed, and at least 1.21? +# Is go installed, and at least 1.26.10 (or 1.27.3+)? go_ok() { set -- $(go version 2>/dev/null | - sed -n 's/.*go\([0-9][0-9]*\)\.\([0-9][0-9]*\).*/\1 \2/p' | + sed -n 's/.*go\([0-9][0-9]*\)\.\([0-9][0-9]*\)\.\([0-9][0-9]*\).*/\1 \2 \3/p' | head -n 1) - [ $# -eq 2 ] && [ "$1" -eq 1 ] && [ "$2" -ge 21 ] + if [ $# -ne 3 ] || [ "$1" -ne 1 ]; then + return 1 + fi + [ "$2" -gt 27 ] || + { [ "$2" -eq 27 ] && [ "$3" -ge 3 ]; } || + { [ "$2" -eq 26 ] && [ "$3" -ge 10 ]; } } # If a local go is installed, use it. set_up_vendored_go() { - GO_VERSION=go1.21.3 + GO_VERSION=go1.27.3 VENDORED_GOROOT="$ROOTDIR/vendor/$GO_VERSION/go" if [ -x "$VENDORED_GOROOT/bin/go" ]; then export GOROOT="$VENDORED_GOROOT" diff --git a/script/install-vendored-go b/script/install-vendored-go index 76d2195..7ec079b 100755 --- a/script/install-vendored-go +++ b/script/install-vendored-go @@ -2,20 +2,24 @@ # The checksums below must correspond to the downloads for this version. # The checksums can be found on https://go.dev/dl -GO_VERSION=go1.21.3 +GO_VERSION=go1.27.3 case "$(uname -s):$(uname -m)" in Linux:x86_64) GO_PKG=${GO_VERSION}.linux-amd64.tar.gz - GO_PKG_SHA=1241381b2843fae5a9707eec1f8fb2ef94d827990582c7c7c32f5bdfbfd420c8 + GO_PKG_SHA=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 + ;; +Linux:aarch64|Linux:arm64) + GO_PKG=${GO_VERSION}.linux-arm64.tar.gz + GO_PKG_SHA=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49 ;; Darwin:x86_64) GO_PKG=${GO_VERSION}.darwin-amd64.tar.gz - GO_PKG_SHA=27014fc69e301d7588a169ca239b3cc609f0aa1abf38528bf0d20d3b259211eb + GO_PKG_SHA=b6f8e931e4ab497fcde6da8ae4499a58f9d258e55c8a80824a516eae5950a750 ;; Darwin:arm64) GO_PKG=${GO_VERSION}.darwin-arm64.tar.gz - GO_PKG_SHA=65302a7a9f7a4834932b3a7a14cb8be51beddda757b567a2f9e0cbd0d7b5a6ab + GO_PKG_SHA=dd3908cf20959d798c1e06ebe5b72213f0505ce01373b40ce3110975a6cd99c2 ;; *) echo 1>&2 "I don't know how to install Go on your platform." From 076dc368353c43f82d61c4dd5e6d41bb8df1ae62 Mon Sep 17 00:00:00 2001 From: Lars Schneider Date: Thu, 12 Nov 2026 12:01:11 +0000 Subject: [PATCH 4/6] Update test and release workflows to Go 1.27.3 Build releases and run CI tests with Go 1.27.3 instead of Go 1.21 so published binaries include current Go stdlib security fixes (CVE-2026-111943). Also drop the macos-15 runner pin that was only needed for Go 1.21 linker output. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5946d63-5054-4db7-8484-2db48414dc6e --- .github/workflows/release.yml | 5 ++--- .github/workflows/test.yml | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c6ce177..c27ae27 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,10 +15,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Setup - uses: - actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.21 + go-version: '1.27.3' - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 89d59a4..75d310d 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -9,13 +9,12 @@ jobs: matrix: os: [ubuntu-latest, macos-latest, windows-latest] fail-fast: false - # Preserve Go 1.21 coverage: macOS 26 rejects its linker output without LC_UUID. - runs-on: ${{ matrix.os == 'macos-latest' && 'macos-15' || matrix.os }} + runs-on: ${{ matrix.os }} steps: - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: '1.21.3' + go-version: '1.27.3' - name: Check out code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 From 9305a30491e31667b752be6a70ac9ee6fc6be331 Mon Sep 17 00:00:00 2001 From: Lars Schneider Date: Thu, 12 Nov 2026 12:01:11 +0000 Subject: [PATCH 5/6] Document automated GitHub Actions release Pushing a "v*" tag now builds the platform archives and creates a draft release via release.yml instead of requiring manual local uploads. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5946d63-5054-4db7-8484-2db48414dc6e --- docs/RELEASING.md | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/docs/RELEASING.md b/docs/RELEASING.md index 5656dd8..43ba19d 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -6,16 +6,8 @@ git tag -as v$VERSION git push origin v$VERSION -2. Build the release for the major platforms: + Pushing the tag triggers `.github/workflows/release.yml`, which builds the release archives for all supported platforms and creates a draft release on GitHub. - make releases VERSION=$VERSION +2. Go to the [releases page](https://github.com/github/git-sizer/releases). - The output is a bunch of ZIP files written to directory `releases/`. - -3. Go to the [releases page](https://github.com/github/git-sizer/releases). - -4. Click on "Draft a new release". - -5. Select the tag, add the required information, and upload the zip files. - -6. Click "Publish release". +3. Open the generated draft release, add the release notes, and click "Publish release". From 379b79435745a5d661d75ad4cb69d304819a8475 Mon Sep 17 00:00:00 2001 From: Lars Schneider Date: Thu, 12 Nov 2026 14:07:05 +0000 Subject: [PATCH 6/6] Replace action-gh-release with gh release create Drop the third-party softprops/action-gh-release dependency (whose v1 tag still uses the deprecated node16 runtime) in favor of the preinstalled GitHub CLI on ubuntu-latest. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5946d63-5054-4db7-8484-2db48414dc6e --- .github/workflows/release.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c27ae27..8583203 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -27,8 +27,13 @@ jobs: make releases VERSION="${GITHUB_REF_NAME#v}" - name: Release - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 - with: - draft: true - files: | + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh release create "$GITHUB_REF_NAME" \ + --repo "$GITHUB_REPOSITORY" \ + --draft \ + --verify-tag \ + --title "Release ${GITHUB_REF_NAME#v}" \ + --generate-notes \ releases/git-sizer-*