[jbeckwith-oai]

Summary

• replace the unverified goreleaser/goreleaser-action binary installer with a shared, repository-owned installer that verifies version- and platform-bound SHA-256 digests before extracting GoReleaser
• install and verify the release tool before minting repository/Homebrew write tokens or exposing macOS signing/notarization secrets; install from the trusted workflow checkout so existing historical release tags remain publishable
• exercise the same verified installer in snapshot CI and cover successful installation, tampered archives, ambiguous duplicate digests, and versions without a reviewed digest
• document how to verify GoReleaser's upstream Sigstore signer identity and regenerate the four Linux/macOS host-archive digests when updating the pinned version

Why

Linear SDK-310 identified that SHA-pinning goreleaser/goreleaser-action does not verify the separate GoReleaser archive downloaded and executed by that action. In the release workflow, that executable receives repository/Homebrew write credentials and macOS signing/notarization secrets. Existing attestations cover our output artifacts, not the privileged build tool input.

This change establishes a fail-closed boundary before extraction or privileged execution while preserving the existing GoReleaser configuration, all release target platforms/package formats, artifact attestations, and historical-tag republishing.

Security and regression review

• completed two independent code-review passes plus a seven-file Codex Security diff scan; fixed the identified historical-tag checkout regression before publishing
• verified GoReleaser's upstream checksums.txt.sigstore.json against the exact goreleaser/goreleaser/.github/workflows/release.yml@refs/tags/v2.15.4 identity and GitHub Actions OIDC issuer (cosign verify-blob: Verified OK)
• matched all four committed digests against both the upstream signed checksum manifest and GitHub release asset metadata
• downloaded and verified the actual Linux/x86_64 runner archive and macOS/arm64 archive
• confirmed structurally that verification occurs before historical-tag checkout, repository/Homebrew token creation, and macOS signing/notarization secret exposure

Verification

• ./scripts/test-goreleaser-installer
• bash -n scripts/install-goreleaser scripts/test-goreleaser-installer
• go build ./...
• go test ./internal/...
• go test ./pkg/cmd -run 'Test(ValidateBaseURL|FormatJSON|MTLSClientFlags|NewMTLSHTTPClient|MultipartRequestBody|ExactLengthUpload)'
• go mod verify
• verified GoReleaser 2.15.4: goreleaser check
• verified GoReleaser 2.15.4: goreleaser release --snapshot --clean --skip=publish (all nine Linux/macOS/Windows targets, existing archives/Linux packages, and Homebrew cask succeeded)
• parsed all changed GitHub Actions YAML and checked historical release tags v1.8.0 / v1.7.1 against the corrected workflow ordering

SDK-310

[Copilot]

Pull request overview

This PR hardens the release pipeline by replacing the GoReleaser GitHub Action’s unverified archive installer with a repository-owned installer that verifies reviewed SHA-256 digests before extracting and running GoReleaser, and ensures this happens before any privileged tokens or signing/notarization secrets are created/exposed.

Changes:

• Add scripts/install-goreleaser to download a pinned GoReleaser release asset and verify it against .goreleaser-checksums before extraction/installation.
• Update CI and publish workflows to use a new composite action (./.github/actions/setup-goreleaser) and run GoReleaser via the verified installation rather than goreleaser/goreleaser-action.
• Add a focused installer verification test script and document the digest regeneration + Sigstore verification process for updating the pinned version.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
scripts/test-goreleaser-installer	Adds verification tests covering success, tampering, ambiguous digests, and missing reviewed digests.
scripts/install-goreleaser	Implements a fail-closed GoReleaser installer that verifies a reviewed SHA-256 digest before extraction.
docs/releasing.md	Documents how to verify upstream Sigstore identity and regenerate the reviewed host-archive digests.
.goreleaser-checksums	Adds reviewed SHA-256 digests for the pinned GoReleaser host archives.
.github/workflows/publish-release.yml	Installs verified GoReleaser before tag checkout and before minting write tokens / exposing secrets; runs GoReleaser directly.
.github/workflows/ci.yml	Exercises the verified installer in CI and runs snapshot GoReleaser using the verified setup.
.github/actions/setup-goreleaser/action.yml	Introduces a composite action wrapper for installing and adding the verified GoReleaser to PATH.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[HAYDEN-OAI]

Independently verified the upstream Sigstore release-workflow identity and all four version/platform-bound SHA-256 digests; confirmed verification happens before archive extraction, write-token creation, and signing/notarization secret exposure; reproduced fail-closed behavior for tampered archives, duplicate/missing digests, malformed versions, and interrupted downloads; validated all 12 existing historical release tags; and successfully reproduced the full nine-target release snapshot (36 artifacts). No substantive security or release-compatibility issues found.