Release Verification

Checksum

sha256sum --check devdoctor.phar.sha256

sha256sum --check devdoctor.sha256

Signature

cosign verify-blob \
  --certificate devdoctor.phar.pem \
  --signature devdoctor.phar.sig \
  --certificate-identity-regexp 'https://github.com/rtcoder/devdoctor/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  devdoctor.phar

cosign verify-blob \
  --certificate devdoctor-linux-x64.pem \
  --signature devdoctor-linux-x64.sig \
  --certificate-identity-regexp 'https://github.com/rtcoder/devdoctor/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  devdoctor-linux-x64

Release Workflow

The release workflow validates tag and Composer version alignment, runs tests and formatting, builds the PHAR on PHP 8.5, packages standalone binaries with PHPacker, smoke tests the Linux binary, signs every executable asset, and publishes release assets.

Version Bump Helper

Use the repository helper before a release when the version changes.

./bump-version 1.41.1

The helper updates Composer metadata, Action examples, documentation pins, CI examples, pinned test expectations, and refreshes composer.lock. Use --no-lock only when intentionally skipping the Composer lock refresh.