Repository navigation
Distribute installable Workstream CLI binaries #562
Description
Outcome
Distribute installable Workstream CLI binaries through one deliberately selected release channel and supported-platform contract.
Current CI builds a temporary Linux binary and exercises it against public APIs, but publishes no user-installable release artifact. Feature commands remain with their lifecycle owners, including #499 for submission/status.
Acceptance criteria
- Record the supported operating systems/architectures, version scheme, release channel, and compatibility statement before publishing artifacts.
- Build versioned binaries reproducibly from the exact release commit and publish integrity metadata through the selected channel.
- Verify clean installation, version output, authenticated API use, upgrade, rollback, and removal on every supported platform.
- Document how users verify the artifact and diagnose an incompatible server or platform without exposing credentials.
- Release automation is least-privileged, pinned, and fails closed on incomplete or mismatched artifacts.
Priority and dependencies
Required infrastructure delivery, next after the CLI API-coverage and end-to-end experience audit, per the product owner's updated direction. Depends on the merged Go CLI and an explicit supported-platform/release-channel decision. The earlier closure as not planned is superseded.
Exclusions
No optional TUI, new product commands, mandatory cryptographic signing scheme without a separate owner decision, package-manager sprawl, or claim that source-build CI is public distribution.
Activity
Abiorh001 commentedon Oct 14, 2026
Closed as not planned for the current end-to-end v0.1 scope, per the product owner’s correction. I added this deferred/future tracker beyond the requested scope. This closure does not claim the work is implemented and does not make it a release prerequisite.
Abiorh001 commentedon Oct 23, 2026
Product-owner direction supersedes the earlier deferral: installable CLI binary distribution is required and is the next implementation task after the current CLI API-coverage and end-to-end experience audit. Retain the existing acceptance criteria for explicit supported platforms, versioned release artifacts, integrity verification, clean installation, upgrade/rollback/removal, and least-privileged release automation. Source-build availability is not completed distribution. No TUI or new backend API scope is implied.
Abiorh001 commentedon Oct 23, 2026
Confirmed first-release platform scope with the product owner: Linux x86-64, macOS Intel, macOS Apple Silicon, and Windows x86-64. Each supported target requires native executable/installation verification; cross-compilation alone is not proof. Distribution implementation is proceeding independently of the optional TUI design. No release or tag is published yet.
Abiorh001 commentedon Oct 23, 2026
Publication preflight, 2026-10-23: #664 is merged. Its final PR proof run passed native build/install/API/upgrade/rollback/removal smoke on Linux amd64, macOS amd64, macOS arm64 and Windows amd64, followed by exact four-archive assembly. These were CI preview artifacts, not a public release. There is still no
cli-v*tag or GitHub Release, so #562 remains open.Read-only repository preflight found no
cli-releaseenvironment (the environment list contains onlyloop-memory-start) and no active tag ruleset. The merged workflow fails closed until an administrator configurescli-releasewith a required independent human reviewer, self-review prevention and exactly amainbranch deployment policy, plus one active repository tag ruleset namedWorkstream CLI immutable tagstargetingrefs/tags/cli-v*with update and deletion restrictions and no bypass actors. An independent administrator must verify the tag-ruleset bypass list before approval because the workflow token cannot see it. GitHub environment settings also permit administrator approval bypass by default; disable that option and verify it manually, since the current workflow validator does not check it.mainis marked protected, but its required PR reviews and status checks are currently unset. A reviewed-source protection decision is therefore still needed before publication. A proposed first tag is annotatedcli-v0.1.0after #665 merges and its integrated checks pass, on a specifically approved then-currentmaincommit (the present7f6a71a69daf563742b72c706e6d09aa742ac25eis only a snapshot, not a frozen release target). The release operator and separate human approver must be chosen explicitly. The publisher already requests only job-scopedGITHUB_TOKENpermissions (contents: write,actions: read); no PAT or production credential is proposed.After those human decisions and protections are verified, the approved operator may create the exact tag and invoke the manual protected workflow. Independently download the five public assets, check hashes and install on all four supported platforms before closing this issue. No tag, release, workflow dispatch or repository setting was changed by this preflight.
Abiorh001 commentedon Oct 23, 2026
Source hardening follow-up: draft PR #668 extends the existing CLI release-control
validator to require literal
can_admins_bypass: false. True, null, omitted,string and numeric-zero responses reject. The new tests fail on the merged
pre-fix guard; pure tests and focused security/CI/docs review pass. Hosted
preview is now being monitored.
This does not configure GitHub policy, create a tag, dispatch a publisher or
publish a binary. The
cli-releaseenvironment remains unverified (GET 404).Independent approval coordination stays with the product owner. #562 remains
open until actual protected publication and the public-asset audit; PR #664's
merged source preparation alone does not complete this distribution outcome.
Abiorh001 commentedon Oct 26, 2026
Operational continuation of the merged release plan: configure only the previously approved cli-release environment (independent reviewer, prevent self-review, sole main branch policy) and one active Workstream CLI immutable tags ruleset for refs/tags/cli-v*, denying update/deletion with no bypass actors. Read back and validate exact controls before any tag or dispatch. Current authenticated operator is repository admin; named reviewer has admin access. Administrator environment bypass is a documented UI-only setting, so no undocumented API field will be sent and publication remains blocked until literal false is verified. No approver contact, source changes, secrets, existing environment changes, tag or publication in this preparation step. Issue remains open until actual public assets and native installation verification.
Abiorh001 commentedon Oct 26, 2026
Release-protection preparation completed and read back (2026-10-26): cli-release environment25327200255 has exact approved User reviewer1890097, prevent_self_review=true, custom branch policy solely main (policy64374038). Active repository tag ruleset25863185 Workstream CLI immutable tags targets exactly refs/tags/cli-v*, excludes none, restricts update/deletion, admin GET explicitly reports bypass_actors:[]. Canonical ruleset validator passes. Environment validator correctly FAILS because can_admins_bypass is still true. Required owner UI action: Settings → Environments → cli-release → deselect Allow administrators to bypass configured protection rules and Save. API docs do not expose a supported PUT field for this control; no undocumented write attempted. No approver contact, tag, dispatch, public release, secrets or existing-environment changes. Issue remains OPEN. Independent operational plan/security review passed with exact reviewer/explicit no-bypass readback safeguards; publication and public install audit remain blocked until the UI setting is read back as literal false.
Abiorh001 commentedon Oct 26, 2026
First-release preflight: can_admins_bypass is now literal false. Canonical environment/ruleset validators PASS, including separate exact reviewer User1890097 and explicit empty tag bypass list checks. Proposed annotated cli-v0.1.0 source is f043138, a main ancestor with successful Backend40135831632. CLI, backend, scripts, release workflow, LICENSE and packaging attributes are byte-identical to current main596975b2; newer changes are MCP/docs only. No existing CLI tag/release found. Bounded operation: create only the approved first tag, dispatch existing protected workflow from main, monitor native proofs/assembly, then stop for independent environment approval. No automatic approval, approver contact, protection change or issue closure. Public asset audit remains required after publication.
Abiorh001 commentedon Oct 26, 2026
First CLI publication has reached the independent human approval boundary. Run: https://github.com/Flow-Research/workstream/actions/runs/40287872334 (attempt 1). Prepare, release protections, all four native platform proofs, and assembly passed. Publish is waiting on the cli-release environment; the operator cannot approve it. Administrator bypass remains disabled and self-review prevention remains enabled. The immutable annotated cli-v0.1.0 tag object is 809b28f52859a405848f036f921926d5e8bd6f31 and its source is f043138. Workflow dispatch ran at main a3c98c3; the intervening main delta was independently reviewed and release inputs remained unchanged. No approval or bypass was attempted, and no approver was contacted. Publication has not happened. This issue remains open for publication and subsequent independent public-asset download, checksum and clean-install verification across the four supported platforms.
Abiorh001 commentedon Oct 26, 2026
CLI readiness reconciliation: release run 40287872334 has passed all four native jobs and assembly but publication is still waiting for independent environment approval; no public cli-v0.1.0 release was found. Remaining distribution acceptance is publication followed by independent public download/checksum and clean-install checks on all four targets. Native prepublication proof must not be labelled public installation proof. CLI local connected lifecycle evidence is in WS-CLI-001-43; hosted API/worker deployment (#583), live S3 verification (#582), and durable-worker uncertain-delivery drill (#581) remain separate open product evidence boundaries. README clarification is being prepared; this issue stays open.