Harden synchronization and release verification

.github/workflows/ci.yml

@@ -4,9 +4,8 @@ on:
   push:
     branches:
       - main
-    tags:
-      - "v*"
   pull_request:
+  workflow_call:
   workflow_dispatch:
 
 permissions:
@@ -115,7 +114,38 @@ jobs:
           cache: true
           cache-dependency-path: go.sum
       - name: Test
-        run: go test -timeout 30m ./...
+        shell: pwsh
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $false
+          $logs = Join-Path $env:RUNNER_TEMP 'spas-native-tests'
+          New-Item -ItemType Directory -Path $logs -Force | Out-Null
+          $timing = [ordered]@{
+            commit = $env:GITHUB_SHA
+            startUtc = [DateTimeOffset]::UtcNow.ToString('o')
+            endUtc = $null
+            exitCode = $null
+          }
+          $timing | ConvertTo-Json -Depth 3 | Set-Content -LiteralPath (Join-Path $logs 'command.json')
+          $testExit = 1
+          try {
+            go test -count=1 -json -timeout 30m ./... 2> (Join-Path $logs 'stderr.log') |
+              Tee-Object -FilePath (Join-Path $logs 'tests.jsonl')
+            $testExit = $LASTEXITCODE
+          }
+          finally {
+            $timing.endUtc = [DateTimeOffset]::UtcNow.ToString('o')
+            $timing.exitCode = $testExit
+            $timing | ConvertTo-Json -Depth 3 | Set-Content -LiteralPath (Join-Path $logs 'command.json')
+          }
+          exit $testExit
+      - name: Upload native test timing
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-test-timing-${{ matrix.name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/spas-native-tests/
+          if-no-files-found: warn
+          retention-days: 14
       - name: Vet
         run: go vet ./...
 

.github/workflows/codeql.yml

@@ -9,6 +9,7 @@ on:
       - main
   schedule:
     - cron: "17 4 * * 3"
+  workflow_call:
   workflow_dispatch:
 
 permissions:

.github/workflows/release.yml

@@ -13,12 +13,30 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  verify:
+    name: Verify release source
+    permissions:
+      contents: read
+    uses: ./.github/workflows/ci.yml
+
+  codeql:
+    name: Analyze release source
+    permissions:
+      contents: read
+      security-events: write
+    uses: ./.github/workflows/codeql.yml
+
   release:
     name: Build draft release
+    needs:
+      - verify
+      - codeql
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     steps:
       - name: Validate semantic version tag
         shell: bash
@@ -38,10 +56,6 @@ jobs:
           go-version-file: go.mod
           cache: true
           cache-dependency-path: go.sum
-      - name: Verify modules
-        run: go mod verify
-      - name: Test tagged source
-        run: go test ./...
       - name: Build draft release
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
@@ -50,3 +64,7 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Attest build provenance
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-checksums: dist/checksums.txt

README.md

@@ -18,9 +18,9 @@ SPAS (pronounced **"/spæz/"**) seamlessly connects your local workspace to a se
 
 ---
 
-Every project relies on files that don't belong in the public or shared Git repository: local `.env` secrets, developer overrides, test fixtures, API mocks, and internal team notes.
+Every project relies on files that don't belong in the public or shared Git repository: local `.env` files, developer overrides, test fixtures, API mocks, and internal team notes.
 
-Moving these files elsewhere breaks build paths. Copying them manually across machines is slow and error-prone. Committing them risks secret leaks and repo bloat.
+Moving these files elsewhere breaks build paths. Copying them manually across machines is slow and error-prone. Committing them exposes them to every collaborator and bloats history.
 
 **SPAS solves this by bridging the gap:**
 
@@ -114,7 +114,7 @@ spas sync
 
 ### 3. Workflow Summary
 
-1. **`spas link`** — Connects your project workspace to the dedicated asset repository (offline).
+1. **`spas link`** — Connects your project workspace to the dedicated asset repository and warns when that repository is publicly readable.
 2. **`spas add`** — Tracks chosen files and creates local exclusion rules in `.git/info/exclude` (offline).
 3. **`spas sync`** — Validates, commits, merges, and synchronizes assets with GitHub.
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/getspas/spas
 
-go 1.26.5
+go 1.26.8
 
 require (
 	github.com/spf13/cobra v1.10.2