The README's "Update Procedure" required three web UIs (GitHub branch
defaults, GitHub releases, Gitea "Synchronize Now") and a go-swagger CLI
installed nowhere. Now that lib is main+tags instead of branch-per-version,
replace it with scripts/release.sh driven through the Makefile:
- `make install-swagger` installs a pinned go-swagger (v0.35.0) and
verifies the version.
- `make regen` copies the sibling service specs and regenerates api/
clients exactly as the old `make swagger` ritual did, failing fast if
a sibling spec is missing. Regen output is reviewed/committed as its
own PR, same as any other change.
- `make release VERSION=vX.Y.Z` / `make release-dry-run VERSION=vX.Y.Z`
validate semver + monotonicity, require a clean main checkout synced
with origin/main, tag, push, `gh release create`, and POST to the
Gitea mirror-sync API for the vernonkeenan/lib and work/lib mirrors
(skipped with a loud warning if GITEA_TOKEN is unset).
Also scope the CI push trigger to `main` + `v*` tags instead of every
branch, so PRs (which already run via the `pull_request` trigger) stop
double-running.
Verified locally: bash -n + shellcheck clean; install-swagger into a
temp GOBIN across go-swagger v0.33.2-v0.35.0; semver/monotonicity/
tag-exists/branch/origin-sync validation failure paths; a full regen
against the real sibling specs in a scratch dir (never the checked-out
api/swagger). That regen surfaced a real go-swagger limitation --
documented in the README and as a warning in the script -- reproduced
across all four installable versions: an untagged operation in
sf-gate-vernonkeenan.yaml produces a client that doesn't compile.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
lib is publicly mirrored on code.tnxs.net and had no CI at all. Add
.github/workflows/push.yml gating every push/PR on the private
self-hosted runner (ADR-KV-004): a test job (go build/vet/test) and a
gitleaks secret-scan job using the official docker image directly
(gitleaks/gitleaks-action needs an org license we don't have).
The gitleaks history scan surfaced 6 findings, all illustrative
`example:` JWTs hardcoded by swagger-codegen into the generated Kazoo
API client models and the vendored Kazoo swagger spec — placeholders
from the vendor's public docs, not real credentials. Added a minimal
.gitleaks.toml allowlist scoped to just those four generated files so
CI runs clean without masking real findings elsewhere.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Vernon Keenan