coffey-labs/stalwart-migrator
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

Release binaries for linux amd64 and arm64

Browse Source 
Pushing a v* tag runs .github/workflows/release.yml: vet, test,
govulncheck, then scripts/build-release.sh builds reproducible archives
for linux/amd64 and linux/arm64 with a SHA256SUMS file, and attaches
them to the release. workflow_dispatch takes a tag for a run that never
started. Same shape as ihasmail-oneshot's releases.

Adds a version subcommand, set at build time.

go.mod moves to 1.26.8: the workflow builds with the go.mod version,
and govulncheck finds four standard-library vulnerabilities the tool
reaches in 1.26.5 (GO-2026-6218, GO-2026-6090, GO-2026-5972,
GO-2026-5026), all fixed in 1.26.6.

README installs from the latest release, with building from source as
the alternative; CONTRIBUTING describes how releases are cut.
This commit is contained in:
jcoffey-dev
2026-09-15 14:26:05 -07:00
parent f3a4d021ab
commit 0543931616
6 changed files with 157 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CONTRIBUTING.md
+20 -1
View File
@@ -10,7 +10,7 @@ go build ./...
go test ./...
```
Requires Go 1.26 or newer. The tool is Go standard library only — no external
Requires Go 1.26.8 or newer. The tool is Go standard library only — no external
dependencies — and nothing third-party is vendored.
To try a command from a checkout without installing it:
@@ -22,6 +22,25 @@ sudo go run ./cmd/stalwart-migrate preflight
[docs/rehearsal.md](docs/rehearsal.md) explains why even read-only commands need
write access to the checkpoint directory.
## Releases
Releases are tagged by date, like ihasmail's: `v2026.9.15`, with `.1`, `.2`
added for another release the same day. Binaries for `linux/amd64` and
`linux/arm64` and a `SHA256SUMS` file are attached to every
[release](https://github.com/Coffey-Labs/stalwart-migrator/releases).
Every release is built by the [release workflow](.github/workflows/release.yml)
from a tagged commit on `main`, after the tests and a known-vulnerabilities
check pass. The archives are reproducible: `scripts/build-release.sh` builds the
same bytes from the same commit, so a release can be checked before tagging:
```sh
scripts/build-release.sh v2026.9.15 dist
```
If a pushed tag's run never starts, run the workflow by hand from the Actions
tab and give it the tag.
## Why not a shell script
Stalwart's 0.15 → 0.16 boundary is not a drop-in binary swap: settings move,