release: publish optional Packslip manifests

JD
1mo ago
+110-0

Add an optional signed Packslip manifest to HEY releases, describing the existing archives, their packaged completions, and the release-matched hey agent skill.

mise currently installs HEY through its GitHub backend, which already verifies build attestations. This adds explicit platform, archive, and executable mappings published with each release, so installers can use HEY-owned metadata rather than infer the layout from filenames. It preserves the existing archives and their signing.

The manifest exposes the packaged Bash, Zsh, and Fish completions and the complete skill from the release's source commit. Activated mise can use the completions; mise skills sync links the skill for the installed version. The mise tool page gives consumer context.

The v1 format is intended to remain supported for years; release-workflow or security changes can still require maintenance. Please reshape the integration or omit resources that aren't useful. Reuse by other installers, including DotSlash, is a future goal.

Implementation and validation
  • Adds two optional 10-minute jobs after the existing release. Signing has contents-read/OIDC only; a separate upload-only job has contents-write. Signing or staging failure prevents bundle upload and does not affect the existing release jobs. Deleting these jobs reverses the integration.
  • Pins Packslip v1.6.0's full release commit, whose action internally locks CLI archive digests and verifies build provenance. Links the existing release-job archive attestations rather than creating signing-job build claims. The existing workflow path is the durable signing identity.
  • Disposable-container checks passed against v1.7.0: all ten archive SHA-256 digests/sizes and checksum entries, executable/platform/layout mappings, and all three packaged completion paths; source-matched skill Git blob; local throwaway signing and all-artifact verification; archive and signed-payload tamper rejection.
  • The released action's Linux ARM64/x64 CLI digests and build provenance were verified against its committed lock. Default installer success and tamper-before-extraction checks passed using a local download fixture and actual attestation verification.
  • make check passed in a non-root Go 1.27 container; six release-workflow Bats contracts passed. YAML parsing confirmed every existing job unchanged. ShellCheck passed and Zizmor 1.30.1 reported no findings.

Local signing used a throwaway key; production vendor OIDC signing/upload and non-Linux binary execution were not exercised. No release or registry switch is included. A registry change would follow the first verified signed release and successful mise discovery, retaining the old backend for earlier versions.

AI assistance: OpenAI Codex.

Summary by cubic

Publishes an optional signed Packslip manifest with each HEY release, describing the existing archives, the packaged Bash/Zsh/Fish completions, and the skill from the release's source commit. mise already installs HEY through its GitHub backend with attestation verification; this adds explicit platform, archive, and executable mappings so installers can use HEY-owned metadata instead of inferring layout from filenames.

Implementation

  • Adds two optional 10-minute jobs after the existing release: one signs with contents-read/OIDC only, and a separate upload-only job uses contents-write.
  • Signing or staging failure prevents bundle upload but does not affect the existing release jobs; deleting the jobs reverses the integration.
  • Pins Packslip v1.6.0 and links the existing release-job archive attestations rather than creating new signing-job build claims.
  • Adds Bats contracts covering job ordering (no existing job depends on the Packslip jobs), failure isolation, and permission separation.