[scottrogowski]

Why

Every merge needs a reproducible release without local GitHub authentication or manual tagging.

What

Pull requests now enforce a higher manifest version and current generated files. Valid main pushes publish tagged macOS, Linux, and Windows binaries.

Acceptance criteria

• Pull requests reject manifest versions that do not exceed existing stable semantic tags.
• Pull requests validate linting, tests, reconciliation, and generated examples.
• Every main push repeats validation before publishing.
• Valid main pushes create the matching tag, GitHub Release, four platform archives, and checksums.
• Release binaries report the manifest version.

Validation

• make lint
• make test
• Two consecutive make examples runs produced identical files.
• actionlint .github/workflows/*.yml
• GoReleaser built four archives and valid checksums.
• The native release binary reported v0.2.0.

Co-authored-by: Scott Rogowski scott.rogowski@virtahealth.com
Co-authored-by: Claude Code noreply@anthropic.com