feat!: v2 host agent (spectate-agent, protocol v2)

.github/dependabot.yml

@@ -1,11 +1,10 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
 version: 2
 updates:
   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
       interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -0,0 +1,76 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  # The job id is the status check required by the main branch protection.
+  vet-lint:
+    name: vet-lint
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Check formatting
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "::error title=gofmt::Run gofmt -w on: $unformatted"
+            exit 1
+          fi
+
+      - name: Verify modules
+        run: |
+          go mod verify
+          go mod tidy -diff
+
+      - name: Vet (linux, darwin)
+        run: |
+          go vet ./...
+          GOOS=darwin go vet ./...
+
+      - name: Test
+        run: go test -race ./...
+
+      - name: Build
+        run: |
+          CGO_ENABLED=0 go build -trimpath ./...
+          CGO_ENABLED=0 GOOS=darwin go build -trimpath ./...
+
+      - name: Lint install.sh
+        run: shellcheck install.sh
+
+  goreleaser:
+    name: goreleaser check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Check the release configuration
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: check

.github/workflows/release.yml

@@ -1,51 +1,81 @@
-name: Create Release
-concurrency:
-  group: main-release
-  cancel-in-progress: true
+# Publishes a GitHub release for every v2.x.y tag (git tag -s v2.0.0 && git push origin v2.0.0).
+# Stable releases become "latest"; v2.x.y-rc.N tags are pre-releases.
+name: Release
+
 on:
-  workflow_dispatch:
+  push:
+    tags:
+      - "v2.*.*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
-  vet-lint:
-    if: "!contains(github.event.head_commit.message, 'chore(release):')"
-    runs-on: ubuntu-latest
+  test:
+    name: vet + test -race
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v2
-
-      - name: Setup Go
-        uses: actions/setup-go@v2
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          go-version: '1.21.x'
+          persist-credentials: false
 
-      - name: Install dependencies
-        run: |
-          go version
-          go mod download
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
 
-      - name: Run vet
+      - name: Vet and test
         run: |
+          test -z "$(gofmt -l .)"
           go vet ./...
+          GOOS=darwin go vet ./...
+          go test -race ./...
 
-  semantic-release:
-    needs: vet-lint
-    runs-on: ubuntu-latest
-    outputs:
-      version_updated: ${{ steps.check_version.outputs.version_updated }}
+  release:
+    name: goreleaser
+    needs: test
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v2
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Node
-        uses: actions/setup-node@v2
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          node-version: '20'
+          go-version-file: go.mod
+          cache: false
 
-      - name: NPM install
-        run: npm ci
+      # Never publish an unsigned release: agents verify checksums.txt.sig
+      # with the public key embedded at build time (README "Release signing").
+      - name: Require the release signing key
+        env:
+          SPECTATE_RELEASE_SIGNING_KEY: ${{ secrets.SPECTATE_RELEASE_SIGNING_KEY }}
+          SPECTATE_RELEASE_PUBLIC_KEY: ${{ vars.SPECTATE_RELEASE_PUBLIC_KEY }}
+        run: |
+          if [ -z "$SPECTATE_RELEASE_SIGNING_KEY" ] || [ -z "$SPECTATE_RELEASE_PUBLIC_KEY" ]; then
+            echo "::error title=Release signing::Set the SPECTATE_RELEASE_SIGNING_KEY secret and the SPECTATE_RELEASE_PUBLIC_KEY variable (README, Release signing)"
+            exit 1
+          fi
 
-      - name: Run semantic-release
-        run: npx semantic-release
+      - name: Release
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SPECTATE_RELEASE_SIGNING_KEY: ${{ secrets.SPECTATE_RELEASE_SIGNING_KEY }}
+          SPECTATE_RELEASE_PUBLIC_KEY: ${{ vars.SPECTATE_RELEASE_PUBLIC_KEY }}