chore: consolidate and harden release workflows by lifeizhou-ap · Pull Request #10447 · aaif-goose/goose

lifeizhou-ap · 2026-07-14T09:05:54Z

Summary

Why

CLI archives and Desktop bundles use the same goose-cli binary. This PR builds it once per macOS target and Windows variant, then reuses it for both packages—reducing duplicate work and keeping artifacts consistent.

Change

Refactor the release automation so CLI and desktop artifacts share platform-specific build workflows while reducing duplication and tightening security.

consolidate macOS and Windows CLI/desktop packaging into reusable workflows
move Linux CLI builds into a dedicated reusable workflow
update release, canary, and npm publishing pipelines to use the new workflows
centralize Cargo version updates in scripts/set-cargo-version.sh
apply least-privilege permissions, remove unnecessary secret inheritance, and pin the remaining unpinned action
exclude internal unsigned artifacts from published releases
remove obsolete PR-comment, manual-build, and maintenance workflows
remove redundant Rust cache configuration

Release workflow

flowchart TD
    R["release.yml"] --> L["build-cli-linux.yml<br/>Linux CLI"]
    R --> LD["bundle-desktop-linux.yml<br/>Linux Desktop"]
    R --> M["bundle-macos.yml<br/>ARM64 and x64"]
    R --> W["bundle-windows.yml<br/>Standard and CUDA"]
    R --> I["Install script"]

    M --> MB["Build goose-cli once per target"]
    MB --> MC["CLI archive"]
    MB --> MD["Desktop bundle"]

    W --> WB["Build goose-cli once per variant"]
    WB --> WC["CLI archive"]
    WB --> WD["Desktop bundle"]

    L --> P["Collect, attest, and publish artifacts"]
    LD --> P
    I --> P
    MC --> P
    MD --> P
    WC --> P
    WD --> P

Testing

Created a branch named "release/pr-10447-test" and push the change to trigger release (without publish and sign) https://github.com/aaif-goose/goose/actions/runs/29479600721

…chain includes cache already

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cc27a059c0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-15T23:41:56Z

+          name: internal-goose-${{ inputs.target }}
+          path: artifacts/internal-goose-${{ inputs.target }}
+          if-no-files-found: error
+          retention-days: 1


Keep macOS signing input artifacts past approval delays

When signing is true, package-desktop does not start until the signing environment is approved, but this internal binary expires after the minimum 1-day retention window (actions/upload-artifact documents retention-days as the duration after which an artifact expires). If a tagged release waits more than a day for signing approval, the later download of internal-goose-${{ inputs.target }} fails and the signed macOS release cannot be packaged; use the default retention or a window that covers expected approval delays.

Useful? React with 👍 / 👎.

1 day is enough based on previous release data

chatgpt-codex-connector · 2026-07-15T23:41:57Z

+          name: internal-windows-unsigned${{ inputs.windows_variant == 'cuda' && '-cuda' || '' }}
          path: ui/desktop/dist-windows/
+          if-no-files-found: error
+          retention-days: 1


Keep Windows signing artifacts past approval delays

For signed Windows releases, this unsigned distribution is uploaded before sign-desktop-windows waits on the signing environment, but it expires after only 1 day (actions/upload-artifact documents retention-days as the duration after which an artifact expires). If signing approval takes longer than that, the signing job cannot download internal-windows-unsigned... and the Windows release fails; use the default retention or a window that covers expected approval delays.

Useful? React with 👍 / 👎.

1 day is enough based on previous release data

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 35ba958892

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-16T00:18:26Z

+    permissions:
+      contents: read


Grant OIDC permission to the Windows reusable workflow

When build-cli.yml is used by publish-npm.yml or the .build-cli PR comment workflow, this caller job limits the reusable workflow to contents: read, but .github/workflows/bundle-windows.yml declares permissions: id-token: write at the workflow level. GitHub validates reusable workflow permissions against the caller job, so the Windows CLI matrix is rejected before it builds even though signing and package_desktop are false; either allow id-token: write here or move the OIDC permission down to the signing job that actually needs it.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4858324c71

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-16T04:25:13Z

+  bundle-windows:
    needs: [prepare-version]
-    uses: ./.github/workflows/bundle-desktop-windows.yml
+    uses: ./.github/workflows/bundle-windows.yml


Grant OIDC permission for Windows canaries

On pushes to main, this Windows reusable workflow is called from a workflow whose top-level permissions now only grant contents: read, while .github/workflows/bundle-windows.yml requests id-token: write at the workflow level. GitHub's reusable-workflow permissions can only be downgraded, not elevated, so the standard Windows canary job (and the CUDA call below) is rejected before its skipped signing path is considered; add id-token: write here or move the OIDC permission into the signing job.

Useful? React with 👍 / 👎.

jamadeo

Much needed thank you Lifei!

lifeizhou-ap added 2 commits July 14, 2026 13:58

refactor build-cli

57a20ef

removed duplicated cache actions as actions-rust-lang/setup-rust-tool…

19273e9

…chain includes cache already

github-advanced-security AI found potential problems Jul 14, 2026

View reviewed changes

Comment thread .github/workflows/build-cli-windows.yml Fixed

github-advanced-security AI found potential problems Jul 14, 2026

View reviewed changes

Comment thread .github/workflows/build-cli-linux.yml Fixed

Comment thread .github/workflows/build-cli-macos.yml Fixed

Comment thread .github/workflows/build-cli-windows.yml Fixed

Comment thread .github/workflows/build-cli-windows.yml Fixed

lifeizhou-ap added 4 commits July 16, 2026 08:24

added reusable release cli and desktop for macos

ea0a26a

added reusable release cli and desktop for windows

9221ab4

used correct file names

bd8e0b4

removed duplication set version in the workflow files

cc27a05

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

lifeizhou-ap added 2 commits July 16, 2026 10:04

reused the bundle desktop and windows workflow to build cli

833f09c

removed unnecessary config

35ba958

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

lifeizhou-ap added 3 commits July 16, 2026 10:47

removed unused workflow

d88d1e7

make publish npm more secure

04e62bf

Harden release workflow permissions

4858324

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

lifeizhou-ap added 4 commits July 16, 2026 14:31

Harden bundle windows permission

202fbb8

Harden bundle linux permission

b190714

removed unnecessary secrete inherited

d7b2285

pin action sha

868c5c7

github-advanced-security AI found potential problems Jul 16, 2026

View reviewed changes

Comment thread .github/workflows/pr-comment-build-cli.yml Fixed

lifeizhou-ap added 3 commits July 16, 2026 15:22

enabled workflow dispatch for bundle cli and desktop

6db8d66

used options for workflow dispatch input

d92db4e

used github provided branch input

a2197f4

lifeizhou-ap changed the title ~~Lifei/release only cli~~ chore: release workflow improvement Jul 16, 2026

lifeizhou-ap changed the title ~~chore: release workflow improvement~~ chore: consolidate and harden release workflows Jul 16, 2026

jamadeo approved these changes Jul 16, 2026

View reviewed changes

lifeizhou-ap added this pull request to the merge queue Jul 16, 2026

Merged via the queue into main with commit af9f3d2 Jul 16, 2026
42 of 46 checks passed

lifeizhou-ap deleted the lifei/release-only-cli branch July 16, 2026 22:48

github-actions Bot mentioned this pull request Jul 21, 2026

chore(release): release version 1.44.0 #10610

Closed

Uh oh!

Conversation

lifeizhou-ap commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Change

Release workflow

Testing

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

lifeizhou-ap Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

lifeizhou-ap Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

lifeizhou-ap Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

lifeizhou-ap Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jamadeo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lifeizhou-ap commented Jul 14, 2026 •

edited

Loading