Release darwin binaries and tarballs

[jeremy]

Closes #32.

This finishes the darwin stub that's been commented out in release-build.yml since 9e39eaa (2023) — the deb/rpm steps were already if: matrix.os == 'linux'-guarded, so darwin slots straight into the matrix.

What

Commit 1 — darwin + tarballs + pipeline repair:

• os: [linux, darwin] in the build matrix; every os/arch pair now also produces quickhook-<version>-<os>-<arch>.tar.gz with the binary at the archive root (where tool managers like mise's github backend expect it — mise use github:dirk/quickhook resolves these with no overrides, and archives outrank the .deb in its asset scoring). Linux tarballs also give bare-binary installs a path that doesn't need dpkg/rpm.
• Repairs the release pipeline, which fails today on retired actions: upload-artifact@v3 (retired Jan 2025; dependabot only bumped the download half) → v4 with per-matrix name: release-<os>-<arch> (v4 artifacts are immutable per name), verify workflows download with pattern: release-linux-* + merge-multiple: true. setup-go@v3 → v7 and ruby/setup-ruby@v1.146.0 → v1 (the v3 runner detection hard-fails on current images).
• README: "Linux" → "Binary downloads", fixes the stale v1.5.0 pre-linux-naming URLs, adds tarball + mise instructions. (Tarball URLs will resolve from the next release onward.)
• Renames build-linux → build since it's no longer linux-only.

Commit 2 — severable if you'd rather keep hand-rolled uploads: a publish job in release.yml (needs both verifies, contents: write) that downloads all release-* artifacts and drafts the GitHub release with --generate-notes and every asset attached — publishing the draft stays a human step. Gated to main, so test dispatches only build and verify.

Evidence

Dispatched release.yml on this branch with a throwaway version (v1.6.2.test3, at the current head): https://github.com/dirk/quickhook/actions/runs/30329291457 — all four build jobs and both verifies green, publish skipped (off-main as designed). Downloaded the artifacts: quickhook-<version>-darwin-arm64.tar.gz contains a Mach-O 64-bit arm64 executable at the archive root that runs on my Mac and reports the test version; linux artifacts carry .deb, .rpm, and .tar.gz each.

(Unrelated, deliberately not touched: go-install builds report --version as "main" since VERSION is sed-rewritten only at release build.)

[Copilot]

Pull request overview

This PR updates the release pipeline to build and publish macOS (darwin) binaries alongside Linux assets, and adds plain .tar.gz archives for tool-manager-friendly installs (e.g., mise) in addition to existing .deb/.rpm Linux packages.

Changes:

• Expand the release build matrix to include darwin and produce quickhook-<version>-<os>-<arch>.tar.gz for each OS/arch pair.
• Repair GitHub Actions workflow compatibility by upgrading retired actions and adjusting artifact naming/downloading for upload-artifact@v4.
• Update README install instructions to reflect new asset naming and add mise-based installation guidance.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Updates install docs for new tarball assets and platform-agnostic “Binary downloads” section.
.github/workflows/release.yml	Renames build job, updates dependencies, and adds an (optional) draft-release publish job.
.github/workflows/release-build.yml	Adds darwin to the build matrix, produces tarballs, and migrates artifact upload to v4 with per-matrix names.
.github/workflows/release-verify-deb-ubuntu.yml	Updates artifact download to match new artifact naming/patterns.
.github/workflows/release-verify-rpm-rhel.yml	Updates artifact download to match new artifact naming/patterns.

Comments suppressed due to low confidence (2)

README.md:76

• Consider using curl instead of wget in the .deb download example as well, so the docs work on minimal systems where wget is not installed by default.

# Installing a .deb
wget https://github.com/dirk/quickhook/releases/download/v1.6.2/quickhook-1.6.2-linux-amd64.deb
sudo apt install ./quickhook-1.6.2-linux-amd64.deb

README.md:80

• Consider using curl instead of wget in the .rpm download example as well, so the docs work on minimal systems where wget is not installed by default.

# Installing a .rpm
wget https://github.com/dirk/quickhook/releases/download/v1.6.2/quickhook-1.6.2-linux-amd64.rpm
sudo rpm --install quickhook-1.6.2-linux-amd64.rpm

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

README.md:72

• The README says tarballs ship starting with the first release after v1.6.2, but the tarball example URL points at the v1.6.2 tag. Since this workflow only drafts/releases assets for the newly-created tag, v1.6.2 will never gain a darwin tarball, so the example will remain broken/misleading.

# Installing a tarball (the binary sits at the archive root)
curl -LO https://github.com/dirk/quickhook/releases/download/v1.6.2/quickhook-1.6.2-darwin-arm64.tar.gz
tar -xzf quickhook-1.6.2-darwin-arm64.tar.gz quickhook  # then move it onto your $PATH

[jeremy]

Fixed — the tarball example now uses a <version> placeholder (a v1.6.2-pinned tarball URL would never resolve, since tarballs ship starting with the first release after v1.6.2). The deb/rpm examples keep the concrete v1.6.2 URLs — verified those assets exist on that release. Docs-only commit.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

.github/workflows/release-build.yml:63

• The new tarball assets aren’t validated during the build. A malformed archive (wrong path inside the tarball, missing executable bit, wrong binary type, etc.) would still upload successfully and only be discovered after release. Consider adding a quick sanity check here to ensure the tarball contains a single quickhook entry at the archive root, and that the extracted binary at least reports the expected version on Linux (and looks like a Mach-O for darwin).

      - name: Package tarballs
        run: |
          tar -czf quickhook-${{ inputs.version }}-${{ matrix.os }}-${{ matrix.arch }}.tar.gz -C build/usr/bin quickhook

.github/workflows/release.yml:60

• The publish step relies on bare globs (*.deb *.rpm *.tar.gz) and unvalidated user input when constructing the release. If any glob unexpectedly matches nothing (or the version contains whitespace/shell metacharacters), gh release create can fail in a non-obvious way. Consider enabling nullglob, validating the version string, and passing an explicit file list to gh.

          gh release create "v${{ needs.version.outputs.version }}" \
            --repo "${{ github.repository }}" \
            --draft \
            --generate-notes \
            *.deb *.rpm *.tar.gz

[jeremy]

YAGNI. Went another route internally.