Release v0.4.0

.gitea/workflows/build.yaml

@@ -1,19 +0,0 @@
-name: build
-on:
-  push:
-    branches: ['**']
-    tags: ['v*']
-jobs:
-  go:
-    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/go.yaml@v1
-    with:
-      go-version: '1.26'
-      golangci-lint: true
-      race: true
-      test-args: -coverpkg=./internal/...,./cmd/... -covermode=atomic -coverprofile=cover.out
-      # 100% coverage gate (.testcoverage.yml), then the plain build.
-      commands: |
-        go run github.com/vladopajic/go-test-coverage/v2@v2.18.8 --config=.testcoverage.yml
-        go build ./...
-      release-commands: scripts/build-release.sh "${GITHUB_REF_NAME#v}"
-      artifacts: dist/*

.github/workflows/ci.yml

@@ -0,0 +1,121 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - develop
+      - main
+      - release/**
+      - rc/**
+  push:
+    branches:
+      - develop
+      - main
+      - release/**
+      - rc/**
+
+permissions:
+  contents: read
+
+jobs:
+  go-checks:
+    name: Go checks
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.26"
+          cache: true
+
+      - name: Check formatting
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "The following files are not gofmt-clean:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: Run go vet
+        run: go vet ./...
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          # v8 installs golangci-lint v2.x, which understands the v2 .golangci.yml
+          # schema (version/formatters). latest pulls a build made with a current Go
+          # toolchain, satisfying the module's go directive.
+          version: latest
+
+      - name: Run tests with coverage profile
+        run: |
+          go test ./... -race \
+            -coverpkg=./internal/...,./cmd/... \
+            -covermode=atomic \
+            -coverprofile=cover.out
+
+      - name: Upload coverage profile
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-profile-${{ github.run_id }}-${{ github.sha }}
+          path: cover.out
+          if-no-files-found: error
+
+      - name: Enforce 100% coverage gate
+        # go-test-coverage is a CI-only tool, run via `go run` so it never becomes a
+        # go.mod dependency. The gate FAILS the build when total coverage on
+        # ./internal/...,./cmd/... drops below the 100 threshold in .testcoverage.yml,
+        # which documents the only two exclusions (the main() shim and gen_spdx.go).
+        run: go run github.com/vladopajic/go-test-coverage/v2@v2.18.8 --config=.testcoverage.yml
+
+      - name: Build
+        run: go build ./...
+
+  macos-build:
+    name: macOS branch build
+    runs-on: macos-15
+    if: github.event_name == 'push'
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.26"
+          cache: true
+
+      - name: Build binary
+        run: go build -o license-tool ./cmd/license-tool
+
+      - name: Upload branch binary
+        uses: actions/upload-artifact@v7
+        with:
+          name: license-tool-${{ github.run_id }}-${{ github.sha }}-macos
+          path: license-tool
+          if-no-files-found: error
+
+  windows-build:
+    name: Windows branch build
+    runs-on: windows-latest
+    if: github.event_name == 'push'
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.26"
+          cache: true
+
+      - name: Build binary
+        run: go build -o license-tool.exe ./cmd/license-tool
+
+      - name: Upload branch binary
+        uses: actions/upload-artifact@v7
+        with:
+          name: license-tool-${{ github.run_id }}-${{ github.sha }}-windows
+          path: license-tool.exe
+          if-no-files-found: error

.github/workflows/release.yml

@@ -0,0 +1,39 @@
+name: Release
+
+# Run whenever a semver release tag is pushed (e.g. v1.0.0, v1.2.3-rc.1).
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+*"
+
+permissions:
+  contents: write
+
+jobs:
+  goreleaser:
+    name: GoReleaser
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          # GoReleaser needs full history and all tags to compute the changelog
+          # and resolve the previous tag.
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: "1.26.4"
+          cache: true
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
+        with:
+          version: v2.16.0
+          args: release --clean
+        env:
+          # GITHUB_TOKEN publishes the GitHub Release in this repo.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # HOMEBREW_TAP_TOKEN pushes the generated cask to KofTwentyTwo/homebrew-tap.
+          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}

RELEASES.md

@@ -5,8 +5,8 @@ on [RELEASING.md](./RELEASING.md) (which is the short reference) with the comple
 process: integrating feature work, choosing a version, running the gate, tagging, and
 verifying the published artifacts.
 
-Releases are built by `scripts/build-release.sh` and published to the Gitea release by
-the tag build of `.gitea/workflows/build.yaml` (see RELEASING.md). There is **no version constant in source** — the
+Releases are built by [GoReleaser](https://goreleaser.com) and published by the
+`Release` GitHub Actions workflow. There is **no version constant in source** — the
 version is injected at build time via `-ldflags` (`main.version`, `main.commit`,
 `main.date`) when the workflow runs against a pushed tag.
 

RELEASING.md

@@ -4,10 +4,7 @@
 > conflict resolution, tagging, and post-release verification) see [RELEASES.md](./RELEASES.md).
 > This file is the short reference.
 
-CI and releases run on Gitea Actions (`.gitea/workflows/build.yaml`, the shared
-`KofTwentyTwo/ci-workflows` Go workflow). A `v*` tag runs every gate, then
-`scripts/build-release.sh` builds the archives and CI attaches them with a `SHA256SUMS`
-to the tag's Gitea release. `.goreleaser.yaml` remains for local snapshot checks.
+Releases are built with [GoReleaser](https://goreleaser.com) and published by GitHub Actions.
 
 ## Changelog Management
 
@@ -75,8 +72,8 @@ git tag vX.Y.Z-rc.N
 git push origin vX.Y.Z-rc.N
 ```
 
-The tag build creates a Gitea prerelease (any tag with a `-` suffix) with the archives and
-`SHA256SUMS`.
+The `Release` workflow builds all configured target binaries and creates a GitHub prerelease
+(the `release.prerelease: auto` setting marks any tag with a prerelease suffix as a prerelease).
 
 ## Production Release
 
@@ -89,7 +86,7 @@ From `main`:
    git commit -am "docs: changelog for v$VERSION"
    ```
 
-3. Push `main` and wait for CI to pass on the release commit.
+3. Push `main` and wait for CI and CodeQL to pass on the release commit.
 4. Tag and push. Prefer a signed annotated tag:
 
    ```bash
@@ -97,10 +94,41 @@ From `main`:
    git push origin vX.Y.Z
    ```
 
-The tag build runs every CI gate, then `scripts/build-release.sh <version>` cross-compiles the
-mac/linux arm64+amd64 and windows amd64 binaries into `dist/` archives, and CI attaches them
-and a `SHA256SUMS` to the tag's Gitea release.
+The `Release` workflow runs `goreleaser release --clean`, which cross-compiles the
+mac/linux arm64+amd64 and windows amd64 binaries, builds the archives and `checksums.txt`,
+creates the GitHub Release, and publishes the Homebrew cask to:
 
-The Homebrew cask in `KofTwentyTwo/homebrew-tap` is not updated by CI; update it by hand from
-the release's `SHA256SUMS` until the tap has its own workflow.
+```text
+KofTwentyTwo/homebrew-tap
+```
 
+End users install with:
+
+```bash
+brew install --cask KofTwentyTwo/tap/license-tool
+```
+
+## Required GitHub Setup
+
+Create or verify a public Homebrew tap repository:
+
+```text
+KofTwentyTwo/homebrew-tap
+```
+
+Add a repository Actions secret on `KofTwentyTwo/license-tool` named:
+
+```text
+HOMEBREW_TAP_TOKEN
+```
+
+The token needs contents write access to `KofTwentyTwo/homebrew-tap`, because the release
+workflow checks out that repository and commits cask updates. Do not hardcode this token
+in workflow files.
+
+Before the first production release:
+
+- Protect or manage the `main` and `develop` branches according to the branch flow above.
+- Confirm `HOMEBREW_TAP_TOKEN` can write to `KofTwentyTwo/homebrew-tap`.
+- Confirm the local push path works with `git ls-remote --heads origin`.
+- Re-run `goreleaser check` and `goreleaser release --snapshot --clean`.

docs/SESSION-STATE.md

@@ -3,27 +3,30 @@
 **Last Updated:** 2026-06-09
 
 ## Current Status
-**v0.4.0 is RELEASED and verified.** Nothing in progress. Clean stopping point.
-Resume on `develop` (default branch). Working tree clean.
+Releasing **v0.4.0**. All six feature/bugfix branches were integrated into `develop`
+(six `--no-ff` merges, conflicts resolved, combined gate green: gofmt/vet/lint, race
+tests, 100% coverage). CHANGELOG finalized as `[0.4.0] - 2026-06-09`. Promoting
+`develop` → `main` and tagging `v0.4.0` to trigger the GoReleaser `Release` workflow.
 
-## What Was Done (this session)
-- Shipped six issues into v0.4.0: #35 (audit reporting overhaul + self-config exclusion + policy-aware group risk), #29 (init full TUI wizard), #31 (resolve: stop guessing SPDX ids), #34 (remove no-op --quiet/--verbose), #33 (refuse symlinked LICENSE), #30 (confine header detection).
-- Bug fixes #30/#31/#33/#34 were built by parallel worktree-isolated agents (TDD + full gate + PR each).
-- Integrated all six PRs into `develop` (six --no-ff merges, conflicts resolved), combined gate green (100% coverage), promoted `develop` -> `main`, tagged **v0.4.0**.
-- Release workflow succeeded: GitHub Release v0.4.0 (6 assets: checksums + darwin/linux arm64+amd64 + windows amd64), Homebrew cask bumped on `KofTwentyTwo/homebrew-tap`.
-- Authored `RELEASES.md` (full release runbook); added pointer from `RELEASING.md`.
+## What shipped in v0.4.0 (issues closed)
+- #35 audit reporting overhaul (`--summary`, `--group-by`, `--sort`, `--depth`, `--only`, per-group risk + breakdowns, attributable violations, findings parity) + self-config exclusion + policy-aware group risk.
+- #29 init full TUI wizard + live previews + persisted `include`.
+- #31 resolve: stop guessing SPDX ids for ambiguous aliases.
+- #34 remove no-op `--quiet`/`--verbose` flags.
+- #33 refuse to clobber a symlinked LICENSE.
+- #30 confine header detection to contiguous comment lines.
 
-## Branch State
-- `develop` and `main` both at v0.4.0 content; `main` tagged `v0.4.0`. `develop` is one doc commit (this handoff) ahead of `main` after it lands.
-- Six merged local `feature/GH-*` branches remain and can be pruned (`git branch -d ...`); their remotes can be deleted too.
+## Release process
+Documented end-to-end in `RELEASES.md` (full runbook) and `RELEASING.md` (short ref).
+Tag `vX.Y.Z` on `main` triggers `goreleaser release --clean`: GitHub Release + Homebrew
+cask (`KofTwentyTwo/homebrew-tap`). Verify with `gh release view` and
+`brew install --cask KofTwentyTwo/tap/license-tool && license-tool version`.
 
-## Pending / Next Session
-- [ ] Prune merged feature branches (local + remote) if desired.
-- [ ] Verify install on a clean machine: `brew update && brew install --cask KofTwentyTwo/tap/license-tool && license-tool version` (should print v0.4.0).
-- [ ] Deferred LOW follow-ups (own issues if pursued): block-comment de-stacking in detect (#30 scope); `isWriteRefusal` typed-sentinel refactor + remove dead `model.ResolveOptions.Verbose` (#34 scope).
-- [ ] No open issues/PRs outstanding from this work.
+## Open Threads / follow-ups
+- [ ] Deferred LOW items: #41/#30 block-comment de-stacking; #39/#34 `isWriteRefusal` typed-sentinel refactor and the still-dead `model.ResolveOptions.Verbose` field.
+- [ ] #32 (include `**`) was fixed on GH-29.
 
 ## Key Reference
-- Repo: GitHub `KofTwentyTwo/license-tool`. Default branch `develop`; production `main`; tag `vX.Y.Z` on `main` publishes via GoReleaser. Commits reference issues, no AI attribution.
-- Release runbook: `RELEASES.md`. Gate: `gofmt -l .`; `go vet ./...`; `golangci-lint run`; `go test ./... -race -coverpkg=./internal/...,./cmd/... -covermode=atomic -coverprofile=cover.out`; `go run github.com/vladopajic/go-test-coverage/v2@v2.18.8 --config=.testcoverage.yml`.
-- Gotcha: never pipe `go build`/`go test` to `tail` in a `&&` chain — it masks the exit code (bit me during merge integration). The Go filetype uses BLOCK comments (`/* */`), not `//`.
+- Default branch `develop`; production `main`; tags `vX.Y.Z` on `main` publish via GoReleaser.
+- Gate: `gofmt -l .`; `go vet ./...`; `golangci-lint run`; `go test ./... -race -coverpkg=./internal/...,./cmd/... -covermode=atomic -coverprofile=cover.out`; `go run github.com/vladopajic/go-test-coverage/v2@v2.18.8 --config=.testcoverage.yml`. (Do not pipe `go build`/`go test` to `tail` — it masks the exit code.)
+- Repo: GitHub `KofTwentyTwo/license-tool`; commits reference issues, no AI attribution.

docs/TODO.md

@@ -1,15 +1,21 @@
-# TODO
+# TODO: GH-29 Init TUI Wizard
 
-## Shipped in v0.4.0 (2026-06-09)
-- [x] #35 audit reporting overhaul + self-config exclusion + policy-aware group risk
-- [x] #29 init full TUI wizard + live previews + persisted `include`
-- [x] #31 resolve: stop guessing SPDX ids for ambiguous aliases
-- [x] #34 remove no-op `--quiet`/`--verbose` flags
-- [x] #33 refuse to clobber a symlinked LICENSE
-- [x] #30 confine header detection to contiguous comment lines
+## Definition
+- [x] Define full feature specification and MVP boundaries.
+- [x] Update issue #29 with implementation plan once finalized.
 
-## Follow-ups (not yet ticketed)
-- [ ] Prune merged `feature/GH-*` branches (local + remote).
-- [ ] Detect: de-stack multi-block `/* */` headers (deferred from #30; would need care to avoid over-detection).
-- [ ] cmd/applier: replace `isWriteRefusal` substring matching with a typed sentinel error (deferred from #34 to avoid colliding with #33).
-- [ ] model: remove the dead `ResolveOptions.Verbose` field (deferred from #34).
+## Implementation
+- [x] Persist `include` patterns in `.license-tool.yaml`.
+- [x] Add init wizard sample-language catalog and C fallback.
+- [x] Add live preview rendering for example source files.
+- [x] Replace interactive `init` form with full-screen TUI.
+- [x] Preserve deterministic non-TTY `init` behavior.
+- [x] Update README/DEVELOPERS documentation.
+
+## Verification
+- [x] `gofmt -l .`
+- [x] `go vet ./...`
+- [x] `golangci-lint run`
+- [x] `go test ./... -race -coverpkg=./internal/...,./cmd/... -covermode=atomic -coverprofile=cover.out`
+- [x] `go run github.com/vladopajic/go-test-coverage/v2@v2.18.8 --config=.testcoverage.yml`
+- [x] `go build ./...`

scripts/build-release.sh

@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-# Cross-compile the release archives into dist/ (the Gitea CI runs this on v* tags).
-#
-# Same targets, names and ldflags as .goreleaser.yaml: darwin/linux amd64+arm64 and
-# windows amd64; tar.gz everywhere except Windows, which gets a zip.
-#
-# Usage: scripts/build-release.sh <version>   (for example 1.2.3 or 1.2.3-rc.1)
-set -euo pipefail
-
-version=${1:?usage: scripts/build-release.sh <version>}
-commit=$(git rev-parse HEAD)
-date=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-ldflags="-s -w -X main.version=$version -X main.commit=$commit -X main.date=$date"
-
-cd "$(dirname "${BASH_SOURCE[0]}")/.."
-rm -rf dist && mkdir dist
-for target in darwin/amd64 darwin/arm64 linux/amd64 linux/arm64 windows/amd64; do
-   os=${target%/*}
-   arch=${target#*/}
-   name=license-tool_${version}_${os}_${arch}
-   ext=
-   [[ $os == windows ]] && ext=.exe
-   mkdir "dist/$name"
-   CGO_ENABLED=0 GOOS=$os GOARCH=$arch go build -trimpath -ldflags "$ldflags" \
-      -o "dist/$name/license-tool$ext" ./cmd/license-tool
-   cp README.md LICENSE CHANGELOG.md "dist/$name/"
-   if [[ $os == windows ]]; then
-      (cd "dist/$name" && python3 -m zipfile -c "../$name.zip" ./*)
-   else
-      tar -czf "dist/$name.tar.gz" -C "dist/$name" .
-   fi
-   rm -r "dist/${name:?}"
-done
-ls -l dist