# Go CLI Release Automation

> Design, implement, and review secure Go CLI release automation with versioned tags, GoReleaser, GitHub Actions, checksums, signing, provenance, changelogs, Homebrew distribution, least-privilege credentials, verification, and recovery. Use when publishing CLI artifacts, configuring release CI, adding package-manager delivery, or diagnosing a partial or failed release.

- Skill: `lvtd-llc/go-cli-release-automation` (Agent Skill, multi-file: 10 files)
- Install (CLI): `npx skillmds@latest add lvtd-llc/go-cli-release-automation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lvtd-llc/go-cli-release-automation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LVTD-LLC (https://skillmd.com/u/lvtd-llc)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/lvtd-llc/go-cli-release-automation

---


# Go CLI Release Automation

Treat release automation as a state transition with verifiable inputs, immutable
artifacts, least privilege, and an explicit recovery path.

## Core Workflow

1. Define version, supported targets, artifact names, and release authority.
2. Validate release configuration without publishing.
3. Build final artifacts exactly once from a clean tagged commit and generate checksums.
4. Publish through pinned, least-privilege CI with protected environments.
5. Update package-manager metadata from the published artifacts.
6. Install and smoke-test representative artifacts.
7. Record partial state and recover without silently replacing released bytes.

## Read Next

| Task | Load |
|---|---|
| Design and validate the pipeline | `guidelines.md`, `workflows/validate-release-config.md` |
| Publish a tagged release | `workflows/publish-tagged-release.md` |
| Publish Homebrew metadata | `workflows/publish-homebrew-package.md` |
| Recover a failed release | `workflows/recover-failed-release.md` |
| Review security and reproducibility | `references/release-automation/rules.md` |
| Review examples | `references/release-automation/examples.md` |

## Guardrails

- Never release from an unreviewed or dirty source state.
- Do not grant write tokens to pull-request jobs or untrusted code.
- Pin CI actions and use current, supported GoReleaser configuration.
- Do not treat build tags as authorization controls.
- Do not overwrite published artifacts under the same version.
- Do not accept locally rebuilt bytes as recovery evidence.

## Source Notes

Guidance is transformed and paraphrased from Marian Montagnino,
*Building Modern CLI Applications in Go* (Packt, 2023), Chapters 7 and 12-14,
and Ricardo Gerardi, *Powerful Command-Line Applications in Go* (2021).

Verify current configuration against https://goreleaser.com/,
https://docs.github.com/en/actions/reference/security/secure-use, and the
target package manager. Current GoReleaser deprecations must be checked before use.