.goreleaser.yaml

# GoReleaser config for mcp-slack-block-kit.
# https://goreleaser.com/customization/
#
# Locally:   goreleaser build --snapshot --clean
# In CI:     goreleaser release --clean   (triggered by tag push)
#
# Required CI env:
#   GITHUB_TOKEN          — provided by GH Actions; used for the release upload.
#   HOMEBREW_TAP_GITHUB_TOKEN — fine-grained PAT with contents:write on the
#                              <user>/homebrew-tap repo; required for tap push.
version: 2

project_name: mcp-slack-block-kit

before:
  hooks:
    - go mod tidy

builds:
  - id: mcp-slack-block-kit
    main: ./cmd/mcp-slack-block-kit
    binary: mcp-slack-block-kit
    env:
      - CGO_ENABLED=0
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
    # ldflags inject build-time metadata into main.{version,commit,date}.
    # See cmd/mcp-slack-block-kit/main.go for the matching package vars.
    ldflags:
      - -s -w
      - -X main.version={{.Version}}
      - -X main.commit={{.Commit}}
      - -X main.date={{.Date}}

archives:
  - id: default
    formats: [tar.gz]
    name_template: >-
      {{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}
    format_overrides:
      - goos: windows
        formats: [zip]
    files:
      - LICENSE
      - README.md

checksum:
  name_template: checksums.txt
  algorithm: sha256

snapshot:
  version_template: "{{ .Tag }}-next"

changelog:
  sort: asc
  use: github
  filters:
    exclude:
      - "^docs:"
      - "^test:"
      - "^chore:"
  groups:
    - title: Features
      regexp: '^.*?feat(\([[:word:]]+\))??!?:.+$'
      order: 0
    - title: Bug fixes
      regexp: '^.*?fix(\([[:word:]]+\))??!?:.+$'
      order: 1
    - title: Other
      order: 999

# Homebrew tap formula publishing — disabled until the
# `hishamkaram/homebrew-tap` repo + HOMEBREW_TAP_GITHUB_TOKEN secret are
# in place. Re-enable in v0.1.1 by uncommenting and running the release.
# See docs.brew.sh/Taps.
# brews:
#   - name: mcp-slack-block-kit
#     repository:
#       owner: hishamkaram
#       name: homebrew-tap
#       token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
#     homepage: https://github.com/hishamkaram/mcp-slack-block-kit
#     description: "MCP server that converts markdown into Slack Block Kit JSON"
#     license: MIT
#     test: |
#       system "#{bin}/mcp-slack-block-kit", "--version"
#     install: |
#       bin.install "mcp-slack-block-kit"

# CycloneDX SBOM generated via syft (bundled with goreleaser).
sboms:
  - artifacts: archive

# Cosign keyless signing of artifacts and checksums via GitHub OIDC.
# Requires id-token: write permission on the release workflow.
signs:
  - cmd: cosign
    signature: "${artifact}.sig"
    certificate: "${artifact}.pem"
    args:
      - sign-blob
      - "--output-certificate=${certificate}"
      - "--output-signature=${signature}"
      - "${artifact}"
      - --yes
    artifacts: checksum
    output: true

release:
  github:
    owner: hishamkaram
    name: mcp-slack-block-kit
  draft: false
  prerelease: auto
  mode: replace
  header: |
    ## mcp-slack-block-kit {{ .Tag }}

    A single static binary that exposes a [Model Context Protocol][mcp]
    server and a CLI for turning AI-generated markdown into valid
    [Slack Block Kit][bk] JSON. Credential-free, zero external runtime
    dependencies, supply-chain hardened.

    [mcp]: https://modelcontextprotocol.io/
    [bk]: https://docs.slack.dev/block-kit/

    ### Five MCP tools

    - `convert_markdown_to_block_kit` — markdown → Block Kit, with
      auto-mode picker between Slack's new (Feb 2025) `markdown` block
      and full deterministic `rich_text` decomposition.
    - `validate_block_kit` — full Slack constraint validation with
      structured violations + fix hints.
    - `preview_block_kit` — Block Kit Builder URL for one-click visual QA.
    - `lint_block_kit` — near-limit and deprecated-pattern warnings.
    - `split_blocks` — enforce the 50-block-per-message ceiling and
      `only_one_table_allowed`.

    Plus a `convert` CLI subcommand for offline testing without an MCP
    client, and a public Go library at
    `github.com/hishamkaram/mcp-slack-block-kit/block_kit` for embedded use.

    ### Why this and not the alternatives

    - **Mention-sanitization is mandatory by default.** Every text run
      emitted into a Slack `text` field is HTML-entity-escaped, so
      AI-generated `<!channel>`, `<@U…>`, `<#C…>`, `<!subteam^…>` cannot
      broadcast or ping the workspace. Opt-in passthrough via
      `Options.AllowBroadcasts: true`.
    - **Predictable handling of nested elements.** Five non-representable
      patterns (code-in-quote, code-in-list, table-in-quote,
      table-in-list, list-in-quote) are detected and routed through
      rich_text decomposition instead of betting on the markdown block's
      undocumented combination behavior. Ordered lists set `Offset` for
      numbering continuation across splits.
    - **Bounded input.** `Options.MaxInputBytes` (default 256 KiB) keeps
      goldmark from allocating gigabytes on hostile input.
    - **Supply-chain hardened.** Cosign keyless signing of every
      artifact via GitHub OIDC, CycloneDX SBOMs, all GitHub Actions
      pinned to commit SHAs, [OSSF Scorecard][ossf] passing on
      Pinned-Dependencies, Token-Permissions, SAST, Fuzzing,
      Vulnerabilities, License, Binary-Artifacts, Dangerous-Workflow,
      Packaging, Dependency-Update-Tool.

    [ossf]: https://scorecard.dev/viewer/?uri=github.com/hishamkaram/mcp-slack-block-kit

    ### Install

    Go install:

    ```sh
    go install github.com/hishamkaram/mcp-slack-block-kit/cmd/mcp-slack-block-kit@{{ .Tag }}
    ```

    Or grab a prebuilt binary from the assets below — multi-arch
    (linux/darwin/windows × amd64/arm64), all signed.

    > **Note**: Homebrew tap (`brew install hishamkaram/tap/...`) is
    > coming in v0.1.1 once the tap repo + publishing PAT are wired up.

    ### Verify a release artifact (cosign keyless)

    ```sh
    cosign verify-blob \
      --certificate-identity-regexp 'https://github\.com/hishamkaram/mcp-slack-block-kit/.+' \
      --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
      --certificate checksums.txt.pem --signature checksums.txt.sig \
      checksums.txt
    sha256sum -c checksums.txt --ignore-missing
    ```

    ### Use it from Claude Desktop / Cursor / Cline / etc.

    ```json
    {
      "mcpServers": {
        "block_kit": {
          "command": "mcp-slack-block-kit",
          "args": []
        }
      }
    }
    ```

    Full release notes and the upgrade story: see [CHANGELOG.md][cl].

    [cl]: https://github.com/hishamkaram/mcp-slack-block-kit/blob/{{ .Tag }}/CHANGELOG.md
  footer: |
    ---

    **Commits since last release**: see the auto-generated list below.