fix(release): make v0.3.0 releasable and every install path truthful

[Patel230]

Summary

This prepares rho for its first release under the rho name, v0.3.0. After it merges, the release pipeline can actually publish a signed release, and every install path the README offers is either working or labelled "available from v0.3.0".

• VERSION is 0.3.0. The Go proxy already serves v0.1.0, v0.1.1 and v0.2.0; those are hawk-era tags with module github.com/GrayCodeAI/hawk. go.mod now retracts that range.
• release.yml had failed on all 10 runs. It now installs syft, signs checksums.txt inside GoReleaser (cosign keyless, bundle checksums.txt.sigstore.json), and verifies the published signature. It also refuses a tag that disagrees with VERSION or CHANGELOG.md, and takes the release notes from the CHANGELOG section. The Homebrew publisher (which would have failed), the unused packages: write permission and the sibling checkout are gone. GoReleaser now builds all six targets, windows/arm64 included.
• install.sh:
  • uses the correct asset names
  • checks cosign against the exact release-workflow identity (no regexp)
  • always verifies the SHA-256
  • fails closed when cosign is present, warns clearly when it is absent, and RHO_REQUIRE_COSIGN=1 makes cosign mandatory
  • parses flags strictly
  • refuses releases from before the rename
• The GitHub Action installs through install.sh with cosign required. Before, it ran curl | tar on the source tarball and built it with Go.
• README install section is now truthful:
  • prebuilt installs are "available from v0.3.0"
  • go install …@main works today; @latest works from v0.3.0
  • Homebrew and npm are marked not available
• npm packages are kept but marked private, with MIT licence and fixed assembly. flake.nix is removed (it could not evaluate). The ast-grep config is removed (it was never enforced). The systemd unit is fixed. The binary size budget now fails the build instead of only warning.
• New docs/RELEASING.md: release checklist, tag protection, verification steps, and the status of each distribution channel. All claims that release-please manages releases are removed.

Required before tagging v0.3.0 (owner)

scripts/check-release-tag.sh runs both in make release-check and as the first step of release.yml. It refuses a tag unless CHANGELOG.md has a non-empty ## [0.3.0] — YYYY-MM-DD section. This PR leaves the notes under ## [Unreleased] because other campaign PRs are adding entries there in parallel. After the campaign PRs merge, a final release PR should rename [Unreleased] to [0.3.0] — <date> and add a new empty [Unreleased] (see docs/RELEASING.md). Then tag. If you tag without that step, the release job stops before building or publishing anything.

Findings addressed

ID	Outcome
F002	README install section is truthful; install.sh uses rho_* names; the pipeline can produce them.
F018	VERSION 0.3.0; release-please claims removed; rho update compares the real version.
F019	Release pipeline fixed so a tag produces rho_* assets plus a signature; README says "available from v0.3.0"; install.sh refuses hawk-era releases (no hawk_* fallback).
F020	npm: MIT licence, "private": true, meta package and optionalDependencies version stamping, GoReleaser v2 _v8.0 paths; README no longer offers npm; npm/README.md added. Nothing is published (owner decision §1.13).
F021	brews stanza and tap-token env removed; goreleaser check now passes.
F022	syft installed with anchore/sbom-action/download-syft pinned by SHA.
F023	Signing moved into GoReleaser signs:, so nothing downloads into dist/; the post-publish check downloads into a temp dir.
F024	tag == VERSION guard with a CHANGELOG section check; compat matrix stable set to rho 0.3.0 / flux 0.0.1; flake removed (it hardcoded 0.0.1); npm stamps the version.
F025	README uses @main (checked today) and explains @latest; go.mod retracts [v0.1.0, v0.2.0]; tagging v0.3.0 is the owner's step.
F026	make release no longer publishes (replaced by release-check and release-snapshot). Editing the v0.2.0 release notes is left to the owner (see Follow-ups).
F027 / F211 / F263	flake.nix and the use flake .envrc removed; /.envrc gitignored.
F028	Already in place: tag ruleset protect-release-tags (id 24053191) covers refs/tags/v* with admin bypass. Documented in docs/RELEASING.md.
F029 / F260	install.sh: strict flag loop, exact --certificate-identity, fail-closed cosign, RHO_REQUIRE_COSIGN=1, SHA-256 always checked.
F030	SIZE_LIMIT_MB := 70 in the Makefile is the only budget; make size-check exits 1 above it; CI runs it.
F031 / F254	Action installs verified release archives through install.sh with cosign required; strips the leading v; validates inputs; release.yml no longer clones flux; stale ci.yml branch mapping removed.
F032	systemd unit: User=rho, StateDirectory/CacheDirectory with RHO_*_DIR, API key read from an EnvironmentFile instead of argv, Documentation points at the repo; troubleshooting guide updated.
F033	sgconfig.yaml, rules/ and the lefthook ast-grep hook removed (ast-grep 0.39.5 does not even discover sgconfig.yaml).
F259	packages: write removed.
F262	Same fix as F002/F019/F025.
F269	release-please claims removed from CONTRIBUTING, README, docs/versioning.md, docs/compatibility.md, the compat matrix, cmd/rho/main.go and the shared templates.
F270	CHANGELOG history note added; hawk-era sections relabelled [hawk …]; duplicate ### Changed merged; stale references annotated.
F282	windows/arm64 is now built (GoReleaser and the CI matrix), so the README claim is true.

Not reproduced / deferred

• None of the findings were unreproducible. The unverified ones (F211, F254, F259, F260, F262, F263, F269, F270, F282) were all reproduced from source and live checks: gh api returns 404 for merlin, kestrel, shrike, swift, harrier and homebrew-tap; npm view @graycodeai/rho gives E404; the v0.2.0 assets are all hawk_*; go install …/cmd/rho@latest fails with "does not contain package".
• F026 (partial): editing the v0.2.0 release notes is a change to a live release, which this campaign is not allowed to make. Left to the owner.

Verification

All of the following were run in this worktree on darwin/arm64:

• GOWORK=off go build ./...: ok

• GOWORK=off go vet ./...: ok

• go run mvdan.cc/gofumpt@v0.10.0 -l $(git ls-files '*.go'): no output

• GOWORK=off golangci-lint run ./... (v2.1.0): 0 issues

• GOWORK=off make boundaries: all guards passed

• GOWORK=off go test -race -count=1 -p 4 ./...: 146 packages ok. Four more failed with ENOSPC because the shared disk filled up during the run:

  • cmd failed to link ("No space left on device")
  • tests in internal/engine, internal/engine/git and internal/engine/project failed with "no space left on device"

  Rerunning exactly those four with go test -race -count=1 -p 1 passed, so all 150 test packages pass.

• goreleaser check (v2.17.0): passes (base branch: "brews should not be used anymore", exit 1)

• goreleaser release --snapshot --clean --skip=publish,sign (final config): succeeded. It produced:

  • six rho_<ver>_<os>_<arch> archives, including windows_arm64
  • the source archive
  • six SPDX SBOMs (syft 1.46.0)
  • checksums.txt with 13 entries

• GitHub Actions on this PR: all 21 checks pass. That includes the new build (windows/arm64) job, the make size-check budget in build (linux/amd64), the race/coverage tests and markdownlint.

• Signing was not exercised locally. It needs the Actions OIDC token, and cosign is not installed here.

• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/release.yml .github/workflows/ci.yml: clean

• shellcheck -s sh install.sh: clean

• shellcheck scripts/check-release-tag.sh: clean

• New tests (internal/testaudit: install script end to end with stub curl/uname/cosign, release config, tag guard, CHANGELOG structure, VERSION, go.mod retraction, systemd unit; cmd: version display). The install.sh tests fail against the old install.sh (10 of 10 functions).

• Live checks:

  • install.sh and the extracted action step against GitHub today: "latest" is v0.2.0 and is refused as pre-rename; v0.3.0 gives a clear 404; malformed inputs exit 2.
  • go install github.com/GrayCodeAI/rho/cmd/rho@main with a clean GOBIN and proxy.golang.org: works.
  • @latest: fails, as expected, until v0.3.0 exists.

• npm assembly, run on a scratch copy against the snapshot dist/: all six targets and the meta package came out at 0.3.0.

• make size-check: 60 MiB passes; with SIZE_LIMIT_MB=50 it fails.

• markdownlint-cli2 0.18.1: 0 errors on the changed Markdown files.

• Not executed: the systemd unit under systemd (no systemd here; the semantics are from systemd.exec(5) and systemd.unit(5)) and any Nix evaluation (no Nix here).

Follow-ups

• Owner: the final CHANGELOG [0.3.0] section (see above), then push tag v0.3.0; afterwards check the install paths with RHO_REQUIRE_COSIGN=1.
• Owner: optionally edit the v0.2.0 release notes to mark it as the legacy hawk build. Decide whether to keep the orphan v0.1.1 tag (it has no release).
• Branch protection on main still has no required reviews (required_pull_request_reviews: null). That is an owner decision and was not changed here.
• After v0.3.0: add a scheduled CI job that runs install.sh against the latest release.
• Homebrew, npm and Nix channels need the prerequisites listed in docs/RELEASING.md before they are offered.
• docs/COMPETITIVE.md:64 still says rho "already ships script/brew/npm paths". That file belongs to RH-docs.

🤖 Generated with Claude Code