feat: harden git-update workflow

.github/release.yml

@@ -0,0 +1,32 @@
+changelog:
+  exclude:
+    labels:
+      - ignore-for-release
+    authors:
+      - dependabot
+  categories:
+    - title: Breaking Changes
+      labels:
+        - breaking-change
+    - title: Features
+      labels:
+        - feature
+        - enhancement
+    - title: Fixes
+      labels:
+        - bug
+        - fix
+    - title: Documentation
+      labels:
+        - documentation
+        - docs
+    - title: Maintenance
+      labels:
+        - ci
+        - chore
+        - dependencies
+        - refactoring
+        - tests
+    - title: Other Changes
+      labels:
+        - "*"

.github/workflows/ci.yml

@@ -0,0 +1,73 @@
+name: ci
+
+on:
+  push:
+    branches-ignore:
+      - master
+  pull_request:
+    branches:
+      - master
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/[email protected]
+
+      - name: Install Go
+        uses: actions/[email protected]
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: golangci-lint
+        uses: golangci/[email protected]
+        with:
+          version: v2.12.2
+          args: --config=.golangci.yml ./...
+
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/[email protected]
+
+      - name: Install Go
+        uses: actions/[email protected]
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: Test
+        shell: bash
+        run: make test
+
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/[email protected]
+
+      - name: Install Go
+        uses: actions/[email protected]
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: Build
+        shell: bash
+        run: make build

.github/workflows/release.yml

@@ -0,0 +1,98 @@
+name: release
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  verify:
+    name: verify
+    if: github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/[email protected]
+
+      - name: Install Go
+        uses: actions/[email protected]
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: golangci-lint
+        uses: golangci/[email protected]
+        with:
+          version: v2.12.2
+          args: --config=.golangci.yml ./...
+
+      - name: Test
+        shell: bash
+        run: make test
+
+      - name: Build
+        shell: bash
+        run: make build
+
+  release:
+    name: release
+    if: github.ref == 'refs/heads/master'
+    needs: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/[email protected]
+        with:
+          fetch-depth: 0
+
+      - name: Install Go
+        uses: actions/[email protected]
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: Prepare release version
+        id: version
+        shell: bash
+        run: |
+          tag="v0.1.${GITHUB_RUN_NUMBER}"
+          echo "tag=${tag}" >> "${GITHUB_OUTPUT}"
+
+      - name: Build release assets
+        shell: bash
+        run: |
+          mkdir -p dist
+
+          build_time="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
+          commit_hash="${GITHUB_SHA::7}"
+          ldflags="-X 'github.com/Format-C-eft/git-update/internal/config.branch=${GITHUB_REF_NAME}' -X 'github.com/Format-C-eft/git-update/internal/config.commitHash=${commit_hash}' -X 'github.com/Format-C-eft/git-update/internal/config.timeBuild=${build_time}'"
+
+          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
+            goos="${target%/*}"
+            goarch="${target#*/}"
+            output="dist/git-update-${goos}-${goarch}"
+
+            CGO_ENABLED=0 GOOS="${goos}" GOARCH="${goarch}" \
+              go build -ldflags "${ldflags}" -o "${output}" ./cmd/git-update
+          done
+
+          sha256sum dist/* > dist/checksums.txt
+
+      - name: Create GitHub Release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${{ steps.version.outputs.tag }}" \
+            dist/* \
+            --target "${GITHUB_SHA}" \
+            --generate-notes \
+            --fail-on-no-commits

.golangci.yml

@@ -6,27 +6,40 @@ run:
 linters:
   default: none
   enable:
-    - dupl
-    - durationcheck
+    - copyloopvar
     - errorlint
     - errcheck
     - goconst
+    - gocritic
     - gosec
     - govet
     - ineffassign
+    - nilerr
+    - nilnil
+    - nolintlint
     - revive
     - staticcheck
+    - unconvert
     - unused
     - wsl_v5
   settings:
-    dupl:
-      threshold: 100
     goconst:
       min-len: 2
       min-occurrences: 2
     govet:
       enable:
         - shadow
+    nolintlint:
+      require-explanation: true
+      require-specific: true
+    revive:
+      rules:
+        - name: exported
+          disabled: true
+        - name: package-comments
+          disabled: true
+        - name: var-naming
+          disabled: true
     wsl_v5:
       enable:
         - assign
@@ -51,25 +64,6 @@ linters:
         - trailing-whitespace
   exclusions:
     generated: lax
-    rules:
-      - path: (.+)\.go$
-        text: G104
-      - path: (.+)\.go$
-        text: G115
-      - path: (.+)\.go$
-        text: G204
-      - path: (.+)\.go$
-        text: should have a package comment
-      - path: (.+)\.go$
-        text: should have comment or be unexported
-      - path: (.+)\.go$
-        text: comment on exported const
-      - path: (.+)\.go$
-        text: should have comment \(or a comment on this block\)
-      - path: (.+)\.go$
-        text: don't use an underscore in package name
-      - path: (.+)\.go$
-        text: package-comments
     paths:
       - bin
       - vendor

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021 platform
+Copyright (c) 2021-2026 Format-C-eft
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal