Skip to content

ci(goreleaser): only generate signature for checksums.txt#1366

Merged
phm07 merged 1 commit intomainfrom
goreleaser-checksum-signature
Apr 2, 2026
Merged

ci(goreleaser): only generate signature for checksums.txt#1366
phm07 merged 1 commit intomainfrom
goreleaser-checksum-signature

Conversation

@phm07
Copy link
Copy Markdown
Contributor

@phm07 phm07 commented Mar 20, 2026 •
edited by jooola
Loading

If we only want to generate a .sig release artifact for checksums.txt, we need to set artifact: checksum.
See https://goreleaser.com/customization/sign/

fix: only generate signature for `checksums.txt` release asset (#1366)

@phm07 phm07 requested a review from a team as a code owner March 20, 2026 17:00
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 20, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.64%. Comparing base (26e799b) to head (549fe3c).
⚠️ Report is 10 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #1366      +/-   ##
==========================================
+ Coverage   72.60%   72.64%   +0.03%     
==========================================
  Files         300      300              
  Lines       11032    11051      +19     
==========================================
+ Hits         8010     8028      +18     
+ Misses       2130     2129       -1     
- Partials      892      894       +2
Flag Coverage Δ
e2e 51.33% <ø> (-0.09%) ⬇️
unit 67.58% <ø> (+0.04%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@apricote
Copy link
Copy Markdown
Member

apricote commented Mar 24, 2026

If we only want to generate a .sig release artifact for checksums.txt, we need to set artifact: checksum.

Do we want that? Can you explain the context of this PR? Is the current setup causing problems?

@phm07
Copy link
Copy Markdown
Contributor Author

phm07 commented Mar 26, 2026

If we only want to generate a .sig release artifact for checksums.txt, we need to set artifact: checksum.

Do we want that? Can you explain the context of this PR? Is the current setup causing problems?

Previously we only generated the signature for checksums.txt, see here:
https://github.com/hetznercloud/cli/releases/tag/v1.61.0
This is enough because checksums.txt contains hashes for all artifacts, so signing it provides the user with a way to verify integrity.

Due to a configuration error, in v1.62.0 each artifact was signed individually as well:
https://github.com/hetznercloud/cli/releases/tag/v1.62.0
This causes unnecessary clutter because the file hashes are already signed.

@phm07 phm07 merged commit 9ec4f2d into main Apr 2, 2026
7 checks passed
@phm07 phm07 deleted the goreleaser-checksum-signature branch April 2, 2026 08:08
@hcloud-bot hcloud-bot mentioned this pull request Mar 30, 2026
Merged
jooola pushed a commit that referenced this pull request Apr 7, 2026
@hcloud-bot
chore(main): release v1.62.1 (#1370)
6dd1849 
<!-- section-start changelog -->
### Bug Fixes

- **server-type**: do not print locations that are unavailable (after
deprecation) (#1369)
- long version info not displayed correctly in release builds (#1374)
- only generate signature for `checksums.txt` release asset (#1366)

<!-- section-end changelog -->

---

<details>
<summary><h4>PR by <a
href="https://github.com/apricote/releaser-pleaser">releaser-pleaser</a>
🤖</h4></summary>

If you want to modify the proposed release, add you overrides here. You
can learn more about the options in the docs.

## Release Notes

### Prefix / Start

This will be added to the start of the release notes.

~~~~rp-prefix
~~~~

### Suffix / End

This will be added to the end of the release notes.

~~~~rp-suffix
~~~~

</details>

Co-authored-by: Hetzner Cloud Bot <>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@apricote apricote apricote approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@phm07 @apricote