Release Process

HostShift releases are allowed only after the source-read-only invariant has been tested in fast, Docker, and VM environments.

Pre-Tag Checklist

• hosted CI manual candidate passed on main
• self-hosted VM E2E Apply passed for the exact commit on the hostshift-vm runner
• make release-snapshot passed locally
• dist/checksums.txt and dist/hostshift.sbom.spdx.json were produced
• git status --short is clean
• CHANGELOG.md has an entry for the version being tagged

Create A Tag

git tag -a v0.3.0 -m "HostShift v0.3.0"
git push origin v0.3.0

The tag-triggered Release workflow publishes GoReleaser artifacts only after quick gates, Docker matrix, hosted Lima preflight, and a successful VM E2E Apply workflow run for the exact release commit pass. A local VM run is useful during development but cannot satisfy this API-verified publication gate.

Verify Checksums

cosign verify-blob \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp 'https://github.com/.*/.github/workflows/release.yml@refs/tags/v.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

shasum -a 256 -c checksums.txt