sixfold-space/madtea

SHA256

Fork 0

feat: home distribution and the self-updater to cheshirecube #430

Merged

hexajon merged 1 commit from issue-421-distribution-home-cheshirecube into main

2026-08-17 19:42:02 +00:00

hexajon commented

2026-08-17 18:35:35 +00:00

Owner

Draft for review. Resolves #421; part of #420.

What

Homes madtea's distribution and self-updater to git.cheshirecube.cloud and backs out the GitHub distribution edge (PR #382). madtea stays a single Gitea/Forgejo API client - no GitHub REST path (ADR 0017).

Changes

internal/meta - single source of truth for project identity (dist host/owner/repo, module path, marketplace). Defaults from project-identity.env, overridable via -ldflags -X. The release-verify key fingerprint stays a pinned const, never a flag.
Self-updater, release.sh, goreleaser (Gitea provider), Homebrew tap, Scoop bucket, plugin marketplace all resolve from cheshirecube. release.sh keeps GITEA_TOKEN; no GITHUB_TOKEN.
ADR 0033 records the reversal and supersedes ADR 0032's distribution-edge decision (0032 body untouched, Status line points forward). ADR 0012 self-updater unchanged except its fetch target.
Docs swept to cheshirecube. go install madtea.lol/... is documented as reachable only from a network that can reach the forge, with GOPRIVATE=madtea.lol, until the forge is fully public; curl / Homebrew / Scoop are the public paths meanwhile.

Decisions baked in

Distribution comes home to cheshirecube; GitHub fully deferred.
go install resolves directly from the SHA-256 forge (verified: git clones it, object format is not a blocker). Default go install needs the forge fully public; until then it is whitelist-reachable-only with GOPRIVATE=madtea.lol.
#386 (the GitHub SHA-1 source sync) is NOT closed. It stays parked as the fallback if vanilla go install fails once the forge is public.

Out-of-repo dependency

The madtea.lol vanity go-import meta lives in madtea-site, not here. It must flip to point at cheshirecube: sixfold-space/madtea-site#46.

Needs a check at first release

The curl one-liner and README use the GitHub-style /releases/latest/download/{asset} path. Confirm the Forgejo instance serves that route at the first release; the brew/scoop templates already use the versioned /releases/download/{tag}/{asset}.

Verification

./scripts/gate.sh green (build, test-race, staticcheck, govulncheck, gosec, docs-verify, cross-compile, mcp-conformance, adr-check). goreleaser check validates the Gitea-provider config. meta_test.go binds the meta defaults to project-identity.env.

Draft for review. Resolves #421; part of #420. ## What Homes madtea's distribution and self-updater to `git.cheshirecube.cloud` and backs out the GitHub distribution edge (PR #382). madtea stays a single Gitea/Forgejo API client - no GitHub REST path (ADR 0017). ## Changes - **internal/meta** - single source of truth for project identity (dist host/owner/repo, module path, marketplace). Defaults from `project-identity.env`, overridable via `-ldflags -X`. The release-verify key fingerprint stays a pinned `const`, never a flag. - **Self-updater, `release.sh`, goreleaser (Gitea provider), Homebrew tap, Scoop bucket, plugin marketplace** all resolve from cheshirecube. `release.sh` keeps `GITEA_TOKEN`; no `GITHUB_TOKEN`. - **ADR 0033** records the reversal and supersedes ADR 0032's distribution-edge decision (0032 body untouched, Status line points forward). ADR 0012 self-updater unchanged except its fetch target. - **Docs** swept to cheshirecube. `go install madtea.lol/...` is documented as reachable only from a network that can reach the forge, with `GOPRIVATE=madtea.lol`, until the forge is fully public; curl / Homebrew / Scoop are the public paths meanwhile. ## Decisions baked in - Distribution comes home to cheshirecube; GitHub fully deferred. - `go install` resolves directly from the SHA-256 forge (verified: git clones it, object format is not a blocker). Default `go install` needs the forge fully public; until then it is whitelist-reachable-only with `GOPRIVATE=madtea.lol`. - **#386** (the GitHub SHA-1 source sync) is NOT closed. It stays parked as the fallback if vanilla `go install` fails once the forge is public. ## Out-of-repo dependency The `madtea.lol` vanity `go-import` meta lives in madtea-site, not here. It must flip to point at cheshirecube: sixfold-space/madtea-site#46. ## Needs a check at first release The curl one-liner and README use the GitHub-style `/releases/latest/download/{asset}` path. Confirm the Forgejo instance serves that route at the first release; the brew/scoop templates already use the versioned `/releases/download/{tag}/{asset}`. ## Verification `./scripts/gate.sh` green (build, test-race, staticcheck, govulncheck, gosec, docs-verify, cross-compile, mcp-conformance, adr-check). `goreleaser check` validates the Gitea-provider config. `meta_test.go` binds the meta defaults to `project-identity.env`.

hexajon added 1 commit

2026-08-17 18:35:35 +00:00

feat: home distribution and the self-updater to cheshirecube

drift / govulncheck (pull_request) Has been skipped

Details

drift / surface-diff (pull_request) Successful in 1m21s

Details

drift / forgejo-smoke (pull_request) Has been skipped

Details

ci / mcp-conformance (pull_request) Successful in 2m1s

Details

ci / gate (pull_request) Successful in 15m35s

Details

ci / mcp-conformance (push) Successful in 58s

Details

drift / govulncheck (push) Has been skipped

Details

drift / surface-diff (push) Successful in 14s

Details

drift / forgejo-smoke (push) Has been skipped

Details

ci / gate (push) Successful in 9m27s

Details

4e6fb7bdd0

Back out the GitHub distribution edge (PR #382) and resolve every
distribution path from git.cheshirecube.cloud. madtea stays one
Gitea/Forgejo API client (ADR 0017, no GitHub REST path).

- internal/meta: single source of truth for project identity. Values
  default to project-identity.env and override via -ldflags -X. The
  release-verify key fingerprint stays a pinned const, never a flag.
- Self-updater, release.sh, the goreleaser Gitea provider, the Homebrew
  tap, the Scoop bucket, and the plugin marketplace URL all resolve from
  cheshirecube.
- ADR 0033 records the reversal and supersedes ADR 0032's distribution
  edge. go install madtea.lol resolves directly from cheshirecube, with a
  temporary GOPRIVATE=madtea.lol requirement until the forge is fully
  public.
- #386 (the GitHub SHA-1 source sync) stays parked as the fallback.

Refs #420.

hexajon merged commit 4e6fb7bdd0 into main

2026-08-17 19:42:02 +00:00

hexajon deleted branch issue-421-distribution-home-cheshirecube

2026-08-17 19:42:02 +00:00

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea!430

No description provided.

Rows
Columns