cardinal 1.61 — a rebuilt release pipeline
A single CI orchestrator, reproducible builds, SBOMs, cosign, and multi-arch packages.
1.61 overhauls how cardinal is built and shipped:
- One orchestrator — the CI pipeline collapses nine reusable workflows into
a single build.yml running lint → test → build → SBOM → cosign → release.
- Reproducible builds —
-trimpath -buildid=produce byte-equivalent
binaries, with sha256 sidecars and a merged SHA256SUMS.txt.
- SBOM & signing — SPDX-JSON software bill of materials, optional cosign
signatures, and a daily govulncheck + gitleaks scan.
- Multi-arch packages —
.deb,.rpm,.apk,.pkg.tar.zst, and
AppImage for amd64 and arm64.
The goal: every release is verifiable from source to binary.