Refresh for v1.1.0: Go 1.26, token from gh, semver listing, install latest and uninstall

.github/dependabot.yml

@@ -0,0 +1,10 @@
+# Keeps the GitHub Actions in .github/workflows at their latest release.
+# The actions are pinned by commit SHA with the release tag in a trailing
+# comment, and Dependabot updates both. The golangci-lint and GoReleaser
+# versions are action inputs, which Dependabot does not update.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/build.yml

@@ -20,14 +20,14 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
-        go-version: '1.24'
+        go-version-file: go.mod
         cache: true
 
     - name: Run tests
@@ -46,7 +46,7 @@ jobs:
         mv bin/educatesenv bin/${{ steps.binary.outputs.name }}
 
     - name: Upload binary
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: ${{ steps.binary.outputs.name }}
         path: bin/${{ steps.binary.outputs.name }}

.github/workflows/golangci-lint.yaml

@@ -5,22 +5,26 @@ on:
     branches:
       - develop
       - main
+  pull_request:
+    branches:
+      - develop
+      - main
 
 jobs:
   golangci:
     name: lint
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: '0'
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.24'
+          go-version-file: go.mod
           cache: true
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: '0'
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: latest
+          version: v2.15.0
           args: -v

.github/workflows/release.yml

@@ -10,34 +10,76 @@ on:
         description: 'Tag or version to build (e.g., v1.2.3). If not set, uses latest commit.'
         required: false
         default: ''
+      skip-signing:
+        description: 'Release without signing and notarizing the macOS binaries, for when the Apple membership or certificate is unavailable.'
+        type: boolean
+        required: false
+        default: false
 
 jobs:
   release:
     name: Create Release
     runs-on: ubuntu-latest
+    env:
+      # false for a manual run with skip-signing, or for any run while the
+      # MACOS_SIGNING repository variable is false; true otherwise. The secrets
+      # check below and .goreleaser.yml both read it to decide whether to sign
+      # and notarize the macOS binaries.
+      MACOS_SIGNING: ${{ ((github.event_name == 'workflow_dispatch' && inputs.skip-signing) || vars.MACOS_SIGNING == 'false') && 'false' || 'true' }}
     permissions:
       contents: write
       # packages: write
       # issues: write
       # id-token: write
 
     steps:
+    # Every release signs and notarizes the macOS binaries unless MACOS_SIGNING
+    # is false. Without this check, an empty notary secret would make
+    # GoReleaser sign the binaries, skip notarization and still succeed.
+    - name: Report a release without macOS signing
+      if: env.MACOS_SIGNING == 'false'
+      run: echo "::warning::This release does not sign or notarize the macOS binaries, because the skip-signing input is set or the MACOS_SIGNING repository variable is false."
+
+    - name: Check the macOS signing and notarization secrets
+      if: env.MACOS_SIGNING != 'false'
+      env:
+        MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
+        MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
+        MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
+        MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
+        MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
+      run: |
+        missing=""
+        for name in MACOS_SIGN_P12 MACOS_SIGN_PASSWORD MACOS_NOTARY_KEY MACOS_NOTARY_KEY_ID MACOS_NOTARY_ISSUER_ID; do
+          if [ -z "${!name}" ]; then
+            missing="$missing $name"
+          fi
+        done
+        if [ -n "$missing" ]; then
+          echo "::error::These secrets are empty or missing:$missing. Set them, or run the workflow manually with skip-signing to release unsigned."
+          exit 1
+        fi
+
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ github.event.inputs.release_tag != '' && github.event.inputs.release_tag || github.ref_type == 'tag' && github.ref_name || github.sha }}
+        # GoReleaser's changelog needs the full history to find the previous
+        # tag.
+        fetch-depth: 0
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
-        go-version: '1.24'
+        go-version-file: go.mod
         cache: true
 
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@v6
+      uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
       with:
-        # 'latest', 'nightly', or a semver
-        version: "~> v2"
+        version: v2.19.0
+        # .goreleaser.yml signs and notarizes unless MACOS_SIGNING, set for the
+        # job above, is false.
         args: release --clean
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.golangci.yml

@@ -3,7 +3,6 @@
 version: "2"
 
 run:
-  go: '1.24'
   timeout: 5m
   modules-download-mode: readonly
   relative-path-mode: gomod

.goreleaser.yml

@@ -5,7 +5,7 @@ version: 2
 builds:
   - main: ./cmd/educatesenv
     id: educatesenv
-    binary: educatesenv-{{ .Os }}-{{ .Arch }}
+    binary: educatesenv
     env:
       - CGO_ENABLED=0
     goos:
@@ -22,6 +22,9 @@ builds:
 archives:
   - formats:
       - binary
+    # Release assets are named educatesenv-<os>-<arch>, as the download
+    # instructions in the release notes header expect.
+    name_template: "{{ .ProjectName }}-{{ .Os }}-{{ .Arch }}"
 
 checksum:
   name_template: 'checksums.txt'
@@ -45,6 +48,12 @@ release:
   # We wait so that we don't make the release public until we have notarize email from Apple.
   draft: true
 
+  # Delete a draft release with the same name, the tag, before creating the
+  # release. A run that fails while uploading leaves a draft behind, and
+  # GitHub's lookup by tag never finds drafts, so without this a rerun would
+  # leave two drafts for the same tag.
+  replace_existing_draft: true
+
   # What to do with the release notes in case there the release already exists.
   #
   # Valid options are:
@@ -103,10 +112,18 @@ changelog:
 notarize:
   macos:
     - # Whether this configuration is enabled or not.
+      #
+      # MACOS_SIGNING switches signing and notarization, the same way for
+      # goreleaser release and goreleaser build. A release signs unless
+      # MACOS_SIGNING is false, so it fails when MACOS_SIGN_P12 is empty or
+      # missing, as well as when signing fails. A snapshot signs only when
+      # MACOS_SIGNING is true, so that snapshots build without the
+      # certificate. The release workflow sets MACOS_SIGNING from its
+      # skip-signing input.
       #
       # Default: false.
       # Templates: allowed.
-      enabled: '{{ isEnvSet "MACOS_SIGN_P12" }}'
+      enabled: '{{ if .IsSnapshot }}{{ eq (tolower (trim (envOrDefault "MACOS_SIGNING" "false"))) "true" }}{{ else }}{{ ne (tolower (trim (envOrDefault "MACOS_SIGNING" "true"))) "false" }}{{ end }}'
 
       # Before notarizing, we need to sign the binary.
       # This block defines the configuration for doing so.