ci: publish GitHub Releases only from main

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.26.6"
+          go-version-file: go.mod
           cache: true
       - name: gofmt
         run: |
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.26.6"
+          go-version-file: go.mod
           cache: true
       - name: Test
         run: go test -race -count=1 ./...
@@ -54,7 +54,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.26.6"
+          go-version-file: go.mod
           cache: true
       - name: govulncheck
         env:
@@ -73,7 +73,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.26.6"
+          go-version-file: go.mod
           cache: true
       - name: Build
         run: go build -o squad-oc ./cmd/squad-oc

.github/workflows/release.yml

@@ -7,6 +7,8 @@ on:
 
 permissions:
   contents: write
+  actions: read
+  checks: read
 
 jobs:
   goreleaser:
@@ -16,10 +18,50 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+      - name: Require tag commit on origin/main
+        run: |
+          git fetch origin main
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
+            echo "::error::tag ${GITHUB_REF_NAME} (${GITHUB_SHA}) is not on origin/main; refusing to release"
+            exit 1
+          fi
+      - name: Wait for ci on tagged commit
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -eu
+          deadline=$((SECONDS + 1200))
+          while true; do
+            json=$(gh run list --repo "$GITHUB_REPOSITORY" --commit "$GITHUB_SHA" --workflow ci.yml --limit 1 --json databaseId,status,conclusion)
+            id=$(printf '%s\n' "$json" | jq -r '.[0].databaseId // empty')
+            status=$(printf '%s\n' "$json" | jq -r '.[0].status // empty')
+            conclusion=$(printf '%s\n' "$json" | jq -r '.[0].conclusion // empty')
+            if [ -n "$id" ] && [ "$status" = "completed" ]; then
+              if [ "$conclusion" = "success" ]; then
+                echo "ci run $id succeeded"
+                exit 0
+              fi
+              echo "::error::ci run $id on ${GITHUB_SHA} concluded ${conclusion}; refusing to release"
+              exit 1
+            fi
+            if [ "$SECONDS" -ge "$deadline" ]; then
+              echo "::error::timed out waiting for ci on ${GITHUB_SHA}"
+              exit 1
+            fi
+            if [ -n "$id" ]; then
+              remaining=$((deadline - SECONDS))
+              echo "ci run $id is ${status}; watching (up to ${remaining}s)"
+              timeout "${remaining}s" gh run watch "$id" --exit-status || true
+              continue
+            fi
+            echo "no ci run yet for ${GITHUB_SHA}; sleeping 15s"
+            sleep 15
+          done
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.26.6"
+          go-version-file: go.mod
+          cache: true
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v7
         with:

CONTRIBUTING.md

@@ -37,6 +37,22 @@ That talks to `opencode serve` on `127.0.0.1:4096`. The TUI (`opencode`) is not
 
 Do not force-push to the default branch. Do not rewrite published tags.
 
+## Cutting a release
+
+1. Merge the PR to `main`.
+2. Wait for the `ci` check on that merge commit to go green.
+3. Tag **that main commit**, not the feature-branch SHA:
+
+   ```bash
+   git checkout main && git pull
+   git tag -a vX.Y.Z -m "squad-oc vX.Y.Z"
+   git push origin vX.Y.Z
+   ```
+
+4. The release workflow checks the tag is on `origin/main`, waits for `ci`, then GoReleaser publishes.
+
+Do not tag a feature branch. Do not move or delete a published `v*` tag. After a squash-merge the feature-branch SHA is not on `main`; tag the squash commit.
+
 ## Signed commits
 
 Commits on the default branch must be **verified** (GPG or SSH signing).