DanConwayDev a57347b3ce feat(release): build portable tagged archives ...

Tagged releases need installable artifacts whose source and embedded revision are pinned to the pushed tag, without requiring operators to have Rust or Nix on the deployment host.

Add a Linux pkgsStatic output and a v* ngit-ci workflow that verifies the tag against Cargo package metadata, builds the x86_64 MUSL binary, creates a reproducible licensed archive and SHA256SUMS, and uploads both as release assets. Derive the Nix package version from Cargo.toml so release validation has one authoritative version.

The first artifact target assumes x86_64 Linux and the existing tag-trigger environment provided by ngit-ci. Multi-architecture archives, OCI publication, release tagging, and the separate v3 metadata promotion are deliberately excluded.

Validated with a staged-tree nix build .#static, static PIE and embedded-revision inspection, an archive/checksum round trip, nix flake check --no-build --no-write-lock-file, cargo metadata, and git diff --check.

2026-08-20 07:00:02 +00:00

..

release.yaml

feat(release): build portable tagged archives

2026-08-20 07:00:02 +00:00

rust_ci.yaml

ci: pass placeholder token to cache-nix-action

2026-08-19 18:26:10 +00:00