[maerlyn5]

Follow-up to #3. This PR makes two changes to .github/workflows/ci.yml: it removes the merge-queue trigger, and it publishes a commit-addressed release for every main commit that passes CI.

Triggers

• CI runs on pull_request and on pushes to main. The fork does not use a merge queue, so merge_group is removed.
• CI is still the single required status check.
• Concurrency: a newer push to a PR cancels that PR's older run. Each main commit runs in its own concurrency group, so a run for a merged commit is never cancelled or skipped before it can publish.

One binary build

• The Linux build job is now a matrix over amd64 and arm64. Each leg builds with CGO_ENABLED=0 -trimpath, so arm64 breakage fails the PR.
• go version -m prints the embedded vcs.revision for each binary.
• Each leg uploads its binary as a workflow artifact.
• No later job or system rebuilds the binaries.

Publish (main only)

publish runs only on push to main and only after the aggregate CI check succeeds. It never runs on PRs.

Permissions: it is the only job with contents: write.

What it does:

1. Downloads the two binaries the build jobs produced.
2. Writes SHA256SUMS.
3. Creates release sha-<full commit SHA>, targeted at that exact commit, with --latest=false. Consumers therefore pin an exact commit rather than following "latest".
4. The release notes link to the source commit and include the checksums.

Asset	Contents
vprox-linux-amd64	static gateway/client binary
vprox-linux-arm64	static gateway/client binary
SHA256SUMS	sha256sum -c format

Nothing is deployed. The gateway and the Modal clients should pin the same sha-<commit> release. Murmuration #12025 copies that approved asset into GCS and verifies it against SHA256SUMS instead of rebuilding. The README's new Releases section documents the download and verification commands. The CLI flags (--tls-cert, --tls-key, --server-name) are unchanged.

Notes for repo settings

• Consider enabling GitHub immutable releases for the fork. Re-running publish already fails if the tag exists, but immutable releases also stop anyone with write access from replacing assets after publication.
• If a tag ruleset restricts tag creation, github-actions[bot] needs to be allowed to create sha-* tags.

Verification

• actionlint reports no errors.
• linux/amd64 and linux/arm64 builds pass with CGO_ENABLED=0.
• I ran the checksum and release-notes script locally against those binaries, and sha256sum -c SHA256SUMS passed.
• The publish job itself can only run after this PR merges. Its first real run will be the merge commit's CI.

Created via Murmur

🤖 Generated with Claude Code

Note

Add commit-tagged release publishing to CI and drop merge_group trigger

• Adds a publish job in ci.yml that runs on successful pushes to main. It downloads both build artifacts, generates SHA256SUMS, and creates a GitHub release tagged sha-<full commit SHA> with amd64 and arm64 binaries and the checksum file. The release is not marked as latest.
• Expands the build job into an amd64/arm64 matrix. Each job uploads its binary as a seven-day artifact.
• Groups concurrency by pull-request number (or commit SHA for pushes) with cancellation of superseded runs, and removes the merge_group trigger.
• Documents the commit-specific releases and checksum verification in README.md.
• Behavioral Change: merge-queue events no longer trigger this workflow; the ci job is now described as the single required check for main.

^{Macroscope summarized c1b117b.}

🐞

Summarization
• Workflow

[macroscopeapp-nonprod]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The workflow will automatically publish public, downloadable releases for every successful commit to the main branch and grants CI permission to write repository contents. Because those artifacts are an outward action that cannot be fully recalled after consumers obtain them, this change should receive human review.

^{You can add or adjust custom eligibility rules. Learn more.}

Dismissing prior approval to re-evaluate c1b117b