Answer architecture round 1: 0 🔴, 7 🟡; build with the gate's Go, guard single-version channels on older tags, record the Cloudsmith tie, and return the tag from publish()

.github/workflows/packages.yml

@@ -6,6 +6,13 @@ on:
       tag:
         type: string
         required: true
+    secrets:
+      TAP_GITHUB_TOKEN:
+        required: true
+      AUR_KEY:
+        required: true
+      CLOUDSMITH_API_KEY:
+        required: true
   workflow_dispatch:
     inputs:
       tag:
@@ -16,6 +23,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: packages
+  cancel-in-progress: false
+
 jobs:
   packages:
     name: Binaries, packages and image for ${{ inputs.tag }}
@@ -36,6 +47,26 @@ jobs:
         with:
           path: tooling
           persist-credentials: false
+      - name: The Go the gate tests
+        id: go
+        run: sed -n 's/^ARG GO_VERSION=/version=/p' tooling/Dockerfile >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-go@v7
+        with:
+          go-version: ${{ steps.go.outputs.version }}
+          cache: false
+      # The tap, the bucket, the AUR and the image's latest tag each hold one version, so
+      # only the latest release updates them.
+      - name: Channels holding one version
+        id: latest
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.tag }}
+        run: |
+          if [ "$(gh release view --repo "$GITHUB_REPOSITORY" --json tagName --jq .tagName)" = "$TAG" ]; then
+            echo "skip=" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=--skip=homebrew,scoop,aur,docker" >> "$GITHUB_OUTPUT"
+          fi
       - uses: docker/setup-buildx-action@v4
       - uses: docker/login-action@v4
         with:
@@ -46,7 +77,7 @@ jobs:
         with:
           version: v2.18.3
           workdir: src
-          args: release --clean --config ../tooling/release-tooling/goreleaser.yaml
+          args: release --clean --config ../tooling/release-tooling/goreleaser.yaml ${{ steps.latest.outputs.skip }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
@@ -59,3 +90,12 @@ jobs:
           for f in dist/*.deb; do cloudsmith push deb --republish larvit/fejkdata/any-distro/any-version "$f"; done
           for f in dist/*.rpm; do cloudsmith push rpm --republish larvit/fejkdata/any-distro/any-version "$f"; done
           for f in dist/*.apk; do cloudsmith push alpine --republish larvit/fejkdata/alpine/any-version "$f"; done
+      - name: The built binary and the published image print the tag
+        env:
+          TAG: ${{ inputs.tag }}
+          IMAGE: ${{ steps.latest.outputs.skip == '' }}
+        run: |
+          test "$(dist/fejkdata_linux_amd64_v1/fejkdata --version)" = "fejkdata $TAG"
+          if [ "$IMAGE" = true ]; then
+            test "$(docker run --rm "ghcr.io/larvit/fejkdata:${TAG#v}" --version)" = "fejkdata $TAG"
+          fi

.github/workflows/test.yml

@@ -81,4 +81,7 @@ jobs:
     uses: ./.github/workflows/packages.yml
     with:
       tag: ${{ needs.release.outputs.tag }}
-    secrets: inherit
+    secrets:
+      TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
+      AUR_KEY: ${{ secrets.AUR_KEY }}
+      CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}