Before publishing a version, confirm the target commit has green CI.
Required checks:
The CI gate verifies these outputs:
dist/checksums.txtdist/draforge_*dist/draforge-controller_*dist/draforge-sim-driver_*charts/draforge-*.tgzManual commands:
pnpm --dir web install --frozen-lockfile --ignore-scripts
pnpm --dir web build
helm lint deploy/helm/draforge
scripts/verify-github-action-pins.sh
scripts/verify-workload-security.sh
scripts/verify-chart-images.sh
scripts/test-chart-image-verifier.sh
scripts/verify-dashboard-exposure.sh
scripts/verify-sim-driver-cdi.sh
mkdir -p charts
helm package deploy/helm/draforge --destination charts
goreleaser release --snapshot --clean --skip=docker,sbom,sign
task release:verify
If a publishing job fails before any asset or image is available, fix the workflow on main and use operation: recover so the immutable tag is revalidated and rebuilt. If publication completed but only post-publish verification failed, use operation: verify; it must not rebuild or republish. If published payloads are invalid, publish a new patch version rather than replacing them silently.