From e43850dc58e5c24854c3cd41a7944c8aaaa7f1b5 Mon Sep 17 00:00:00 2001 From: DAVID AMID Date: Fri, 4 Sep 2026 16:14:37 +0300 Subject: [PATCH] fix(release): the checksum key is singular, so GoReleaser rejected the whole config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `checksums:` is not a field in GoReleaser v2 — the key has always been `checksum:`. The plural made it an unknown field, and GoReleaser refuses to start rather than ignoring it: starting release release failed after 0s error= | yaml: unmarshal errors: | line 71: field checksums not found in type config.Project So the release path produced NOTHING: no archives, no checksums.txt, no assets. Not a wrong filename — a pipeline that never began. Mine, from #141 (b08e5435). What makes it worth stating plainly: #141 added `release.yaml` with a `workflow_dispatch` snapshot entry, and its own commit body said that entry exists so "the release path gets exercised before there is a tag to regret". That workflow had never been run. The first run of it failed on this line, before a tag existed — which is the outcome it was added for, at the cost of the release it was supposed to protect being broken the whole time in between. The `name_template: checksums.txt` under it was correct and is now actually in effect. It matters: GoReleaser's default checksum filename is `{{.ProjectName}}_{{.Version}}_checksums.txt`, and the plugin's install.sh fetches `checksums.txt` — that is the only integrity check in the download path, and it is fail-closed, so a mismatch there refuses the install rather than trusting the tarball. Verified by re-running the same snapshot workflow on this branch rather than by reading: the run that failed on `main` succeeds here, and builds all four archives. Signed-off-by: DAVID AMID --- .goreleaser.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.goreleaser.yaml b/.goreleaser.yaml index d628b18..1dcf8a4 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -68,7 +68,7 @@ archives: - README.md - THIRD-PARTY-NOTICES -checksums: +checksum: # The integrity check for every downloaded artifact, and the ONLY one: these binaries are # unsigned (the tap and signing ownership are still open), so nothing else stands between a # tampered tarball and a proxy that handles the user's LLM traffic.