grep finds no asset to replace on a fresh release; under pipefail that
ended the step silently.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The org PACKAGES_TOKEN got HTTP 403 on the release lookup (license-tool
proof tag); the job token with contents: write creates and fills the
release, so the workflows need no secret.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
go.yaml: gofmt, go vet, optional golangci-lint (pinned, sha256-verified),
go test (optional race), extra gate commands, and on v* tags release
commands plus artifacts with SHA256SUMS on the Gitea release.
gradle.yaml: verified Gradle wrapper (official jar and distribution
checksum), ./gradlew task lines, artifacts on v* tags.
lint.yaml: opt-in shellcheck, yamllint, JSON, ruff, tofu fmt/validate,
markdownlint and ansible-lint; every tool pinned and checksum- or
digest-verified; git-crypt files always skipped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
