forge¶

Forge release operations for Go. A provider contract, a registry, and a credential chain for GitHub, GitLab, Gitea, Codeberg, Bitbucket and plain download sources, with no vendor SDK in the core.

go get gitlab.com/phpboyscout/go/forge

factory, err := forge.Lookup(sourceType)
provider, err := factory(ctx, source, cfg)

rel, err := provider.GetLatestRelease(ctx, owner, repo)

Why¶

• Depend on the contract, not a client. Consuming code takes a forge.Provider, never a *github.Client. Switching forges is a one-line constructor change, not a second code path. See backend agnosticism.
• You pay only for what you use. The core imports no forge SDK (a guard test enforces it) and each provider is its own module, enabled by a blank import.
• Any forge, including one we have never heard of. The registry is keyed by a plain string, so a provider ships as your module with nothing contributed here. See author a provider.
• A credential seam, not a credential chain. A provider asks a CredentialSource for a token. Where that token comes from is your composition: a config key you name, an environment variable, your own vault client. Precedence lives in your config stack, stated once, rather than a second time inside here. See authenticate.
• Credentials pinned to the host they were issued for. Asset URLs come from release metadata, which a release author controls. See credential pinning.
• A conformance harness, not just an interface. The compiler checks your method set; RunProviderConformance checks the protocol the compiler cannot see.

Where next¶

Reference¶

• Providers: supported forges and their capabilities
• Configuration: keys, params, environment variables, defaults
• Errors: every sentinel and what to do with it
• Conformance harness: the field list for RunProviderConformance

The Go API reference is on pkg.go.dev.

Further reading¶

The blog carries a curated route through this subject: CI/CD, and getting things released collects everything written about it, ordered so you can start at the beginning rather than newest-first.