build: refresh release tooling and prepare 0.2.5 notes

[steipete]

Prepare the 0.2.5 patch notes for the local build/install helper in #77 and update repository-owned GoReleaser pins from 2.18.0 to 2.18.1. The patch release includes archive-path reporting fixes, dependency security updates, and temporary-directory cleanup improvements in GoReleaser.

This is the only prepared PR that edits CHANGELOG.md. Merge it after #77; both branches are based independently on main. Released changelog sections are unchanged, and no version, tag, or release is created here.

The dependency sweep found direct Go dependencies and pnpm 12.3.4 current. Retain Go 1.26.7 minimum / 1.26.8 preferred to preserve the existing macOS compatibility decision. Hold the new untagged Ultraviolet revision and unused or dependency-test-only graph updates.

Validation results and exact-head CI are recorded in the proof comment.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[steipete]

Maintainer verification for a36b2e87eea6809bb4f19d4d7ba6fff12cad55cf:

• Exact-head CI passed: https://github.com/steipete/eightctl/actions/runs/34099059907 . This includes formatting, lint, all Go tests, Go 1.26.7 minimum-version tests, release metadata, release-preflight regressions, coverage, release-note smoke checks, and the GoReleaser artifact smoke test.
• Locally, GOTOOLCHAIN=go1.26.8 go test ./... passed. GOTOOLCHAIN=go1.26.8 goreleaser build --snapshot --clean --single-target used GoReleaser 2.18.1 to build a real macOS arm64 artifact; its version and --version both matched dist/metadata.json, and --help succeeded. Release metadata still correctly matches v0.2.4.
• Independent branch autoreview against origin/main is scoped-clean through P2.
• Direct Go dependencies and pnpm 12.3.4 are current. Hold the fresh untagged Ultraviolet revision and unused or dependency-test-only graph updates; retain the Go 1.26.7 minimum / 1.26.8 preference. Existing Action pins are current; checkout's v7 tag already tracks its patch release.

Local verification limit: the release-preflight fixture stalled on this Mac, including one retry in a fresh private temp directory that timed out after 180 seconds. The same fixture passed in exact-head Linux CI for both this PR and #77. Task-created build outputs were removed.

Merge after #77, which carries the implementation. This PR alone carries the ordered Unreleased notes and contributor credit. Recommend patch 0.2.5 after both land; no version bump, tag, or publication was performed.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 7, 2026, 4:19 AM ET / 08:19 UTC.

ClawSweeper review

What this changes

Updates GoReleaser to 2.18.1 in CI and the manual release workflow, and adds Unreleased notes for the local build/install helper.

Merge readiness

✅ Ready for maintainer review

The previous ordering blocker is resolved: the install helper is merged into the reviewed base. The tooling update remains useful, and no introduced correctness or security defect was found.

Priority: P3
Reviewed head: 40b56f7b5638ecf9b3d49fcab41972379b5a0dc1

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused maintenance patch with relevant reported artifact validation and the previous ordering blocker resolved.
Proof confidence	🌊 off-meta tidepool	Not applicable: The OWNER-authored PR is exempt from the external-contributor proof gate; its captured validation additionally reports a real GoReleaser 2.18.1 macOS artifact with matching embedded version metadata.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The OWNER-authored PR is exempt from the external-contributor proof gate; its captured validation additionally reports a real GoReleaser 2.18.1 macOS artifact with matching embedded version metadata.
Evidence reviewed	7 items	Verified introduced scope: The local comparison matches the host-pinned introduction evidence: two version substitutions and seven added changelog lines. Workflow permissions, Action references, publishing arguments, and application code are unchanged. Previous blocker resolved: The supplied GitHub metadata confirms #77 merged at 2026-09-07T08:13:31Z as the reviewed main SHA. Its Makefile implements the build, destination creation, replacement, and macOS signing behavior described by the new notes. Update remains distinct from main and latest release: Current main’s CI and the v0.2.4 manual release workflow still pin GoReleaser 2.18.0. The submitted update is therefore not already implemented by the merged install-helper work.
Findings	None	None.
Security	None	None.

How this fits together

Eightctl’s release tooling builds distributable CLI binaries from Go source and release metadata. CI checks those binaries, while the manual fallback workflow packages releases using the changelog.

flowchart LR
  A[Go source and build configuration] --> B[GoReleaser 2.18.1]
  C[CI smoke check] --> B
  D[Manual release request] --> B
  E[Changelog release notes] --> D
  B --> F[CLI binaries and archives]
  F --> G[Version verification or release publication]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep the repository-owned release-tool pins synchronized and retain accurate Unreleased notes for the merged install helper.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR refreshes build tooling and release notes rather than reporting a reproducible application defect.

Is this the best way to solve the issue?

Yes. Updating both repository-owned pins is a focused change, and the notes now correspond to implementation present on main.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 60ae968f4d84.

Labels

Label changes:

• add P3: This is a bounded release-tool patch update and changelog preparation with no demonstrated urgent user-facing failure.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The OWNER-authored PR is exempt from the external-contributor proof gate; its captured validation additionally reports a real GoReleaser 2.18.1 macOS artifact with matching embedded version metadata.

Label justifications:

• P3: This is a bounded release-tool patch update and changelog preparation with no demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The OWNER-authored PR is exempt from the external-contributor proof gate; its captured validation additionally reports a real GoReleaser 2.18.1 macOS artifact with matching embedded version metadata.

Evidence

What I checked:

• Verified introduced scope: The local comparison matches the host-pinned introduction evidence: two version substitutions and seven added changelog lines. Workflow permissions, Action references, publishing arguments, and application code are unchanged. (.github/workflows/ci.yml:86, 40b56f7b5638)
• Previous blocker resolved: The supplied GitHub metadata confirms build: add make build / make install with the required re-sign #77 merged at 2026-09-07T08:13:31Z as the reviewed main SHA. Its Makefile implements the build, destination creation, replacement, and macOS signing behavior described by the new notes. (Makefile:20, 60ae968f4d84)
• Update remains distinct from main and latest release: Current main’s CI and the v0.2.4 manual release workflow still pin GoReleaser 2.18.0. The submitted update is therefore not already implemented by the merged install-helper work. (.github/workflows/release-legacy.yml:54, 76c73ac3e94f)
• Release boundary and metadata compatibility: The normal signed release delegates to a separate reusable workflow. This patch changes only repository-owned GoReleaser installations; release-note extraction and metadata checks still use finalized version headings, so the Unreleased additions do not advance the package version. (.github/workflows/release-unified.yml:45, 40b56f7b5638)
• Upstream dependency release: The changed workflow directly installs and executes GoReleaser. Its official v2.18.1 release notes confirm archive-path reporting fixes, dependency security updates, and temporary-directory cleanup, matching the changelog description.
• Maintainer validation and review continuity: The captured build: refresh release tooling and prepare 0.2.5 notes #83 (comment) reports a real macOS arm64 artifact built with GoReleaser 2.18.1, with both version forms matching generated metadata. That report covers a36b2e8; the supplied current-head checks also pass. The local release-preflight fixture reportedly timed out, while Linux CI passed. This review executed no builds or target-bundled review helpers. (.github/workflows/ci.yml:89, a36b2e87eea6)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• omarshahine: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-07T08:11:15.298Z sha a36b2e8 :: blocked before merge. :: none