ci(release): build, sign and publish wallet bundles for linux/darwin × amd64/arm64

[TeoSlayer]

Problem

The catalogue's io.pilot.wallet 0.3.3 entry has a single top-level bundle_url: wallet-v0.3.3 on pilot-protocol/pilotprotocol. It contains a darwin/arm64 Mach-O built by hand on a Mac (CGO_ENABLED=1, go1.25.3) and has no bundles map.

• pilotctl before v1.13.10 installs it on every platform, and it then cannot exec:
  • linux/amd64 and linux/arm64 (debian:bookworm-slim): exec /b/bin/wallet: exec format error
  • Intel Mac (arch -x86_64): Bad CPU type in executable
• pilotctl v1.13.10 refuses it with a platform mismatch.

This repo has no releases, no Actions secrets and no release workflow.

Change

.github/workflows/release.yml runs on a v* tag, or on workflow_dispatch with an existing tag:

1. go test -race ./...
2. Native CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' on ubuntu-latest, ubuntu-24.04-arm, macos-15-intel and macos-15. Each job asserts the file output for its target and requires wallet -version to equal the tag.
3. Pins the binary's sha256 into manifest.json and signs it with pilotctl appstore sign, using the PILOT_APP_PUBLISHER_KEY secret. It asserts that the publisher is the catalogue pin ed25519:VF8fdEP/Oe2aWN3ozQ7Ar22137tHb7dkSw0hlzlk/os=.
   • pilotctl is built from pilotprotocol v1.13.10, not main, because this step holds the private key.
4. Packs io.pilot.wallet-<ver>-<os>-<arch>.tar.gz with the new scripts/pack-bundle.py:
   • The layout is manifest.json + bin/wallet, the same entries as the 0.3.3 bundle.
   • Packing is deterministic: owner 0:0, fixed mtime, gzip header without name or time.
   • No macOS AppleDouble or xattr entries.
5. Publishes the four bundles with .sha256 files, checksums.txt and build provenance (actions/attest-build-provenance@v3).

The workflow is based on the unpushed WIP commit eb261f2, with three changes: the pilotctl ref is pinned, packing is deterministic, and the README has a Release section.

Verified locally

• actionlint passes.
• I ran the build job's steps by hand on darwin/arm64:
  • Built with go1.25.13, checked file and -version.
  • Pinned and signed with pilotctl built from v1.13.10 using a throwaway key (the real one is not available here), then packed with pack-bundle.py.
  • The apps-sweep harness verified the resulting bundle: sha256_ok, signature_ok, publisher_pin_ok, Mach-O arm64, native.
• The same flags on all four targets (CGO_ENABLED=0, pure-Go sqlite) give Mach-O arm64, Mach-O x86_64, ELF x86-64 and ELF aarch64.
• Those binaries, built from fix(wallet): exit when the daemon dies, stop per-call logging, never unlink a successor's socket #40, pass the lifecycle harness on all four platforms (see fix(wallet): exit when the daemon dies, stop per-call logging, never unlink a successor's socket #40).
• govulncheck on the wallet: go1.25.11 has 5 reachable stdlib vulnerabilities (crypto/tls, net/http, net/url, encoding/asn1), and go1.25.13 has 0. go-version: '1.25' picks the latest 1.25 patch.

Before the first release (maintainer)

1. Add the repo secret PILOT_APP_PUBLISHER_KEY (the private key for ed25519:VF8f…/os=). gh secret list -R pilot-protocol/wallet is empty today.
2. Merge fix(wallet): exit when the daemon dies, stop per-call logging, never unlink a successor's socket #40, then tag (e.g. v0.4.0: cmd/wallet Version and manifest.json app_version are both 0.4.0).
3. Update the catalogue in pilotprotocol:
   • Add a bundles entry for each platform.
   • Approve the stateful-app bump in catalogue/stateful-apps.json. catalogue-lint blocks wallet updates until the fleet runs a pilotctl with the app-state fix, v1.13.10.
   • Update the metadata and re-sign catalogue.json.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!