From 4984c440c77f0144195ce1d6b1dfc8b0498bc693 Mon Sep 17 00:00:00 2001
From: Kevin Tang <73975146+vt128@users.noreply.github.com>
Date: Mon, 22 Jun 2026 23:49:36 +0800
Subject: [PATCH 1/2] [build] goreleaser cross-platform binaries + release
 workflow (STAR-53)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add prebuilt-binary distribution so the CLI installs without a Go toolchain
(the v0.1.0 cost-price audit's top P1 / biggest adoption barrier — currently
`go install` only, needing Go 1.25).

- .goreleaser.yaml: builds linux/darwin/windows × amd64/arm64 with CGO disabled
  (modernc/sqlite is pure Go, so the whole binary is static and cross-compiles),
  -trimpath + the same version ldflags the Makefile injects (package config),
  tar.gz archives (zip on Windows), checksums, GitHub release.
- .github/workflows/release.yml: on a vX.Y.Z tag, run GoReleaser. The third-party
  goreleaser-action is pinned to a full commit SHA (supply-chain policy). The tag
  is still cut by a human after confirmation; the workflow only turns a tag into
  archives + a Release, and never fires on a PR.
- .gitignore: dist/.

Verified locally: `goreleaser check` passes; `release --snapshot --clean` builds
all six platform archives + checksums, and the native binary's --version banner
is populated from the injected ldflags. Homebrew tap deferred (add a brews: block
when wanted).
---
 .github/workflows/release.yml | 32 ++++++++++++++++++++++++++++++++
 .gitignore                    |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..b231934
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,32 @@
+name: Release
+
+# Build and publish cross-platform binaries when a vX.Y.Z tag is pushed.
+# The tag itself is still cut by a human (after maintainer confirmation) — this
+# workflow only turns an existing tag into prebuilt archives + a GitHub Release.
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # full history for the changelog
+      - uses: actions/setup-go@v6
+        with:
+          go-version: "1.25.x"
+      - name: Run GoReleaser
+        # Third-party action pinned to a full commit SHA (supply-chain policy).
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitignore b/.gitignore
index dd205f6..0fc2f70 100644
--- a/.gitignore
+++ b/.gitignore
@@ -215,3 +215,4 @@ $RECYCLE.BIN/
 /*.yaml
 /*.star
 /coverage.*
+dist/

From e5cb109bd74a280d56745432146eebe9bf206582 Mon Sep 17 00:00:00 2001
From: Kevin Tang <73975146+vt128@users.noreply.github.com>
Date: Mon, 22 Jun 2026 23:50:38 +0800
Subject: [PATCH 2/2] [build] track .goreleaser.yaml (root /*.yaml ignore was
 hiding the config)

---
 .gitignore       |  1 +
 .goreleaser.yaml | 85 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 86 insertions(+)
 create mode 100644 .goreleaser.yaml

diff --git a/.gitignore b/.gitignore
index 0fc2f70..43ffe1c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -213,6 +213,7 @@ $RECYCLE.BIN/
 *.db
 /starcli*
 /*.yaml
+!/.goreleaser.yaml
 /*.star
 /coverage.*
 dist/
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
new file mode 100644
index 0000000..bc75ba0
--- /dev/null
+++ b/.goreleaser.yaml
@@ -0,0 +1,85 @@
+# GoReleaser configuration for starcli — cross-platform prebuilt binaries so the
+# CLI can be installed without a Go toolchain. Validate/iterate locally with:
+#   go run github.com/goreleaser/goreleaser/v2@latest check
+#   go run github.com/goreleaser/goreleaser/v2@latest release --snapshot --clean --skip=publish
+# Releases are produced on a vX.Y.Z tag by .github/workflows/release.yml.
+version: 2
+
+project_name: starcli
+
+before:
+  hooks:
+    - go mod download
+
+builds:
+  - id: starcli
+    main: .
+    binary: starcli
+    # modernc/sqlite is pure Go, so the whole binary builds with CGO disabled —
+    # which is what makes static, cross-compiled binaries possible here.
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    flags:
+      - -trimpath
+    # Inject the same version vars the Makefile sets (package config), so the
+    # released binary's `--version` banner is populated.
+    ldflags:
+      - -s -w
+      - -X github.com/1set/starcli/config.AppName=starcli
+      - -X github.com/1set/starcli/config.GitSummary={{ .Version }}
+      - -X github.com/1set/starcli/config.GitCommit={{ .ShortCommit }}
+      - -X github.com/1set/starcli/config.GitBranch={{ .Branch }}
+      - -X github.com/1set/starcli/config.BuildDate={{ .Date }}
+
+archives:
+  - id: starcli
+    ids:
+      - starcli
+    # tar.gz everywhere, zip on Windows.
+    formats:
+      - tar.gz
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    name_template: >-
+      {{ .ProjectName }}_{{ .Version }}_
+      {{- if eq .Os "darwin" }}macOS{{ else }}{{ .Os }}{{ end }}_{{ .Arch }}
+    files:
+      - README.md
+      - LICENSE*
+
+checksum:
+  name_template: "checksums.txt"
+
+snapshot:
+  version_template: "{{ incpatch .Version }}-snapshot-{{ .ShortCommit }}"
+
+changelog:
+  sort: asc
+  use: github
+  filters:
+    exclude:
+      - "^\\[doc\\]"
+      - "^\\[ci\\]"
+      - "^\\[test\\]"
+      - "^\\[chore\\]"
+      - "merge conflict"
+      - "Merge pull request"
+      - "Merge branch"
+
+release:
+  github:
+    owner: 1set
+    name: starcli
+  # Match the existing release style: explicit, not auto-prerelease.
+  prerelease: auto
+  draft: false
+  mode: keep-existing