Cover release auxiliary assets

Author: RamazanKara

CHANGELOG.md

@@ -41,6 +41,7 @@
 - Added `openexit release-manifest` and `openexit verify-release` for schema-backed release artifact manifests and offline binary/checksum verification.
 - Added a release installer script that detects the local platform, verifies the selected artifact against `SHA256SUMS` and `RELEASE_MANIFEST.json`, and is smoke-tested by the release gate.
 - Added `openexit completion` plus release completion assets for Bash, Zsh, Fish, and PowerShell.
+- Extended release manifests and `SHA256SUMS` to cover installer and shell-completion assets as well as platform binaries.
 - Added `make release-check` and wired the draft-release workflow to run the full release gate before packaging artifacts.
 - Updated push CI to run the same release readiness gate, including smoke pipelines and bundle verification.
 - Updated CI and release workflows to Node.js 24-native GitHub Actions.

Makefile

@@ -7,6 +7,7 @@ LDFLAGS := -s -w -X github.com/RamazanKara/openexit/internal/version.Version=$(V
 GOFILES := $(shell find . -name '*.go' -not -path './bin/*' -not -path './dist/*')
 PLATFORMS ?= linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64
 RELEASE_MANIFEST ?= RELEASE_MANIFEST.json
+RELEASE_ASSETS ?= install.sh openexit.bash _openexit openexit.fish openexit.ps1
 GOLANGCI_LINT_VERSION ?= v2.12.2
 GOLANGCI_LINT ?= bin/golangci-lint
 EXAMPLE_INPUT ?= examples/datadog-to-grafana/input/datadog-fixture.json
@@ -128,14 +129,14 @@ release-dist:
 		echo "building $$out"; \
 		CGO_ENABLED=0 GOOS=$$os GOARCH=$$arch $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o "$$out" ./cmd/openexit; \
 	done
-	cd dist && sha256sum openexit_* > SHA256SUMS
-	$(GO) run -trimpath -ldflags "$(LDFLAGS)" ./cmd/openexit release-manifest --dist dist --out dist/$(RELEASE_MANIFEST) $(foreach target,$(PLATFORMS),--platform $(target))
 	cp scripts/install.sh dist/install.sh
 	chmod +x dist/install.sh
 	$(GO) run -trimpath -ldflags "$(LDFLAGS)" ./cmd/openexit completion bash > dist/openexit.bash
 	$(GO) run -trimpath -ldflags "$(LDFLAGS)" ./cmd/openexit completion zsh > dist/_openexit
 	$(GO) run -trimpath -ldflags "$(LDFLAGS)" ./cmd/openexit completion fish > dist/openexit.fish
 	$(GO) run -trimpath -ldflags "$(LDFLAGS)" ./cmd/openexit completion powershell > dist/openexit.ps1
+	$(GO) run -trimpath -ldflags "$(LDFLAGS)" ./cmd/openexit release-manifest --dist dist --out dist/$(RELEASE_MANIFEST) $(foreach target,$(PLATFORMS),--platform $(target)) $(foreach asset,$(RELEASE_ASSETS),--asset $(asset))
+	cd dist && sha256sum openexit_* $(RELEASE_ASSETS) > SHA256SUMS
 
 install-smoke: release-dist
 	tmp=$$(mktemp -d); \
@@ -151,7 +152,7 @@ release-check: verify release-dist install-smoke
 	@test -s dist/_openexit
 	@test -s dist/openexit.fish
 	@test -s dist/openexit.ps1
-	@expected=$$(printf '%s\n' $(PLATFORMS) | wc -w | tr -d ' '); \
+	@expected=$$(printf '%s\n' $(PLATFORMS) $(RELEASE_ASSETS) | wc -w | tr -d ' '); \
 	actual=$$(wc -l < dist/SHA256SUMS | tr -d ' '); \
 	if [ "$$actual" != "$$expected" ]; then \
 		echo "expected $$expected release checksums, got $$actual"; \

README.md

@@ -136,8 +136,8 @@ Included in the current implementation:
 - Validation report with embedded JSON Schema checks, Grafana dashboard, Prometheus alert, OpenTelemetry collector, ArgoCD, Forgejo migration, identity realm/client, edge VCL/HAProxy/Coraza, and LiteLLM/vLLM candidate checks, YAML/JSON parsing, evidence ref checks, secret scan, and optional `promtool`/`kubeconform` checks.
 - Evidence bundle export with README, checksums, and a schema-backed machine-readable manifest.
 - Offline evidence bundle verification for manifest schema, checksums, digest/size metadata, and archive path safety.
-- Release artifact manifest generation with per-binary OS/architecture metadata, size, and SHA-256 digests.
-- Offline release artifact verification against `RELEASE_MANIFEST.json` and optional `SHA256SUMS`.
+- Release artifact manifest generation with binary OS/architecture metadata, auxiliary asset metadata, sizes, and SHA-256 digests.
+- Offline release artifact verification for binaries and auxiliary assets against `RELEASE_MANIFEST.json` and optional `SHA256SUMS`.
 - Release installer script that selects the current platform binary and verifies it before installation.
 - Shell completion generation for Bash, Zsh, Fish, and PowerShell, including release-provided completion assets.
 - Evidence bundle path-safety checks that reject symlinks in exported project sections.

docs/cli.md

@@ -35,9 +35,9 @@ The checked-in Datadog example can be refreshed with `make example VERSION=0.1.0
 
 `openexit verify-bundle <bundle.zip>` verifies an exported bundle without requiring the original project directory. It checks archive path safety, required bundle files, manifest schema validity, manifest file size/digest metadata, and `checksums.txt`. Use `--json` to feed the verification report into a handover gate.
 
-`openexit release-manifest --dist dist --out dist/RELEASE_MANIFEST.json` writes a machine-readable manifest for release binaries. It records the stamped release version, commit, build date, generation time, and each expected OS/architecture artifact with file name, relative path, size, and SHA-256 digest. The manifest shape is published as `schemas/openexit.release-manifest.schema.json`.
+`openexit release-manifest --dist dist --out dist/RELEASE_MANIFEST.json` writes a machine-readable manifest for release artifacts. It records the stamped release version, commit, build date, generation time, each expected OS/architecture binary, and auxiliary assets such as `install.sh` and shell completions with file name, type, relative path, size, and SHA-256 digest. The manifest shape is published as `schemas/openexit.release-manifest.schema.json`.
 
-`openexit verify-release dist/RELEASE_MANIFEST.json --dist dist --require-checksums` verifies release binaries after download or before publishing. It validates the manifest schema, rejects unsafe artifact paths, recomputes file sizes and SHA-256 digests, and verifies `SHA256SUMS` when required. Use repeatable `--artifact <name>` to verify only the current platform artifact after download, or `--json` to feed the verification report into a release gate.
+`openexit verify-release dist/RELEASE_MANIFEST.json --dist dist --require-checksums` verifies release artifacts after download or before publishing. It validates the manifest schema, rejects unsafe artifact paths, recomputes file sizes and SHA-256 digests, and verifies `SHA256SUMS` when required. Use repeatable `--artifact <name>` to verify only the current platform artifact after download, or `--json` to feed the verification report into a release gate.
 
 `openexit completion bash|zsh|fish|powershell` prints shell completion scripts. Release artifacts also include `openexit.bash`, `_openexit`, `openexit.fish`, and `openexit.ps1` so package managers and manual installs can wire completion without rebuilding from source.
 

docs/release.md

@@ -20,7 +20,7 @@ Release-blocking v0.1 requirements:
 - Validation engine with embedded JSON Schema checks, Grafana dashboard, Prometheus alert, OpenTelemetry collector, ArgoCD, Forgejo migration, identity realm/client, edge VCL/HAProxy/Coraza, and LiteLLM/vLLM candidate checks, YAML/JSON parsing, evidence refs, secret scan, optional promtool, and optional kubeconform.
 - Evidence bundle export with checksums, a schema-backed machine-readable manifest, and OpenExit version metadata.
 - Offline evidence bundle verification for archive path safety, manifest schema, manifest digests, and checksums.
-- Machine-readable release manifest generation and offline release artifact verification for OS/architecture binaries and `SHA256SUMS`.
+- Machine-readable release manifest generation and offline release artifact verification for OS/architecture binaries, auxiliary release assets, and `SHA256SUMS`.
 - Verified release installer for Linux/macOS `amd64` and `arm64` downloads.
 - Shell completion generation and release completion assets for Bash, Zsh, Fish, and PowerShell.
 - No-op AI assist and optional external assist behind explicit opt-in.
@@ -43,7 +43,7 @@ The AI provider path is complete for local fixture assessment workflows and incl
 - [ ] `make verify VERSION=0.1.0` passes, including CLI smoke pipelines.
 - [ ] `make lint` runs `gofmt`, `golangci-lint`, and `go vet`.
 - [ ] `make release-dist VERSION=0.1.0` produces binaries, `dist/SHA256SUMS`, `dist/RELEASE_MANIFEST.json`, `dist/install.sh`, and completion assets `openexit.bash`, `_openexit`, `openexit.fish`, and `openexit.ps1`.
-- [ ] `openexit verify-release dist/RELEASE_MANIFEST.json --dist dist --require-checksums` passes and fails when a release binary is tampered with.
+- [ ] `openexit verify-release dist/RELEASE_MANIFEST.json --dist dist --require-checksums` passes and covers binaries, `install.sh`, and completion assets; it fails when a release artifact is tampered with.
 - [ ] `OPENEXIT_VERSION=0.1.0 OPENEXIT_BASE_URL=$PWD/dist BIN_DIR=$(mktemp -d)/bin sh scripts/install.sh` installs a verified local release binary and `openexit version` reports `0.1.0`.
 - [ ] `make example VERSION=0.1.0-dev` refreshes `examples/datadog-to-grafana/output/` and exports `examples/datadog-to-grafana/openexit-example.zip`.
 - [ ] Datadog definition-of-done pipeline passes:
@@ -73,7 +73,7 @@ The AI provider path is complete for local fixture assessment workflows and incl
 - [ ] Exported bundle README includes version, commit, build date, bundle timestamp, and candidate warning.
 - [ ] Exported bundle `manifest.json` includes build metadata, project source/target, validation totals, and per-file SHA-256 digests, and validates against `schemas/openexit.evidence-bundle.schema.json`.
 - [ ] `openexit verify-bundle <zip>` passes for exported bundles and fails when an archived file is tampered with.
-- [ ] Release manifest validates against `schemas/openexit.release-manifest.schema.json` and includes version, commit, build date, generation time, OS/architecture metadata, sizes, and SHA-256 digests.
+- [ ] Release manifest validates against `schemas/openexit.release-manifest.schema.json` and includes version, commit, build date, generation time, artifact type, binary OS/architecture metadata, sizes, and SHA-256 digests.
 - [ ] Export refuses symlinks in exported project sections, including when `--force` is used.
 - [ ] No credentials, tokens, passwords, or private keys are present in fixtures, generated files, docs, or bundles.
 - [ ] Draft release notes have been reviewed.

docs/schemas.md

@@ -4,6 +4,8 @@ OpenExit schemas live under `schemas/` and mirror the typed Go manifests. Releas
 
 Evidence bundle exports include `openexit-evidence/manifest.json`, which follows `schemas/openexit.evidence-bundle.schema.json`. The manifest records OpenExit build metadata, project source/target metadata, validation totals, and SHA-256 digests for exported project files so downstream review tooling can verify a bundle without parsing every human-readable report first.
 
+Release builds include `RELEASE_MANIFEST.json`, which follows `schemas/openexit.release-manifest.schema.json`. The manifest records OpenExit build metadata and every release artifact that should be covered by `SHA256SUMS`: platform binaries use `type: binary` with `os` and `arch`, while installer and shell-completion files use `type: asset`.
+
 Project manifests must use one of the supported source/target pairs: Datadog to Grafana LGTM, GitHub Enterprise to Forgejo, Okta/Auth0 to Keycloak/Zitadel, Cloudflare/Akamai to Varnish/HAProxy/Coraza, or OpenAI/Anthropic to vLLM/LiteLLM.
 
 Inventory dashboards can include optional `dataSources` and `templateVariables` fields so assessment can flag Grafana mapping risk. Datadog fixture and live collectors populate `metrics` from captured dashboard and monitor queries, including referenced tag keys where available. The live Datadog collector also populates `integrations` from the Datadog v2 Integrations API when accessible. SLOs can include optional `sli`, `burnRateMonitorIds`, and `dashboardRefs` fields. The top-level inventory `volumes` section records whether log and trace volume assumptions are known.

internal/app/command.go

@@ -929,7 +929,7 @@ func writeBundleVerification(w io.Writer, report *openexport.VerificationReport)
 
 func newReleaseManifestCommand() *cobra.Command {
 	var distDir, out, manifestVersion, commit, date string
-	var platforms []string
+	var platforms, assets []string
 	cmd := &cobra.Command{
 		Use:   "release-manifest",
 		Short: "Write a machine-readable OpenExit release artifact manifest",
@@ -952,6 +952,7 @@ func newReleaseManifestCommand() *cobra.Command {
 				Commit:    commit,
 				Date:      date,
 				Platforms: platforms,
+				Assets:    assets,
 			})
 			if err != nil {
 				return err
@@ -970,6 +971,7 @@ func newReleaseManifestCommand() *cobra.Command {
 	cmd.Flags().StringVar(&commit, "commit", "", "Release commit; defaults to the stamped CLI commit")
 	cmd.Flags().StringVar(&date, "date", "", "Release build date; defaults to the stamped CLI date")
 	cmd.Flags().StringArrayVar(&platforms, "platform", nil, "Release target os/arch; repeatable and defaults to the standard release matrix")
+	cmd.Flags().StringArrayVar(&assets, "asset", nil, "Additional non-binary release asset path under --dist; repeatable")
 	return cmd
 }
 

internal/app/e2e_test.go

@@ -133,6 +133,9 @@ func TestReleaseManifestAndVerifyCommands(t *testing.T) {
 			t.Fatalf("write artifact %s: %v", name, err)
 		}
 	}
+	if err := os.WriteFile(filepath.Join(distDir, "install.sh"), []byte("#!/bin/sh\n"), 0o755); err != nil {
+		t.Fatalf("write install asset: %v", err)
+	}
 	manifestPath := filepath.Join(distDir, openrelease.DefaultManifest)
 
 	args := []string{
@@ -146,11 +149,12 @@ func TestReleaseManifestAndVerifyCommands(t *testing.T) {
 	for _, platform := range platforms {
 		args = append(args, "--platform", platform)
 	}
+	args = append(args, "--asset", "install.sh")
 	out, err := executeForTestWithOutput(args...)
 	if err != nil {
 		t.Fatalf("openexit release-manifest failed: %v\n%s", err, out)
 	}
-	if !strings.Contains(out, "artifacts: 2") {
+	if !strings.Contains(out, "artifacts: 3") {
 		t.Fatalf("expected release-manifest artifact count, got:\n%s", out)
 	}
 	manifestData, err := os.ReadFile(manifestPath)
@@ -172,7 +176,7 @@ func TestReleaseManifestAndVerifyCommands(t *testing.T) {
 	if err != nil {
 		t.Fatalf("openexit verify-release failed: %v\n%s", err, out)
 	}
-	for _, marker := range []string{"status: passed", "build: version=9.9.9-test", "artifacts: 2", "checksums: 2"} {
+	for _, marker := range []string{"status: passed", "build: version=9.9.9-test", "artifacts: 3", "checksums: 3"} {
 		if !strings.Contains(out, marker) {
 			t.Fatalf("expected verify-release marker %q, got:\n%s", marker, out)
 		}
@@ -194,7 +198,7 @@ func TestReleaseManifestAndVerifyCommands(t *testing.T) {
 	if err := json.Unmarshal([]byte(jsonOut), &report); err != nil {
 		t.Fatalf("decode verify-release JSON: %v\n%s", err, jsonOut)
 	}
-	if report.Status != "passed" || len(report.Artifacts) != 2 || report.ChecksumEntries != 2 {
+	if report.Status != "passed" || len(report.Artifacts) != 3 || report.ChecksumEntries != 3 {
 		t.Fatalf("unexpected verify-release JSON report: %+v", report)
 	}
 }

internal/release/manifest.go

@@ -24,6 +24,8 @@ const (
 	Kind             = "ReleaseManifest"
 	DefaultManifest  = "RELEASE_MANIFEST.json"
 	ChecksumFileName = "SHA256SUMS"
+	ArtifactBinary   = "binary"
+	ArtifactAsset    = "asset"
 )
 
 var DefaultPlatforms = []string{
@@ -50,8 +52,9 @@ type Build struct {
 
 type Artifact struct {
 	Name   string `json:"name"`
-	OS     string `json:"os"`
-	Arch   string `json:"arch"`
+	Type   string `json:"type"`
+	OS     string `json:"os,omitempty"`
+	Arch   string `json:"arch,omitempty"`
 	Path   string `json:"path"`
 	Size   int64  `json:"size"`
 	SHA256 string `json:"sha256"`
@@ -63,6 +66,7 @@ type ManifestOptions struct {
 	Commit      string
 	Date        string
 	Platforms   []string
+	Assets      []string
 	GeneratedAt time.Time
 }
 
@@ -86,6 +90,7 @@ type VerificationReport struct {
 
 type ArtifactVerification struct {
 	Name   string   `json:"name"`
+	Type   string   `json:"type"`
 	OS     string   `json:"os"`
 	Arch   string   `json:"arch"`
 	Path   string   `json:"path"`
@@ -142,13 +147,34 @@ func Generate(opts ManifestOptions) (*Manifest, error) {
 		}
 		manifest.Artifacts = append(manifest.Artifacts, Artifact{
 			Name:   name,
+			Type:   ArtifactBinary,
 			OS:     osName,
 			Arch:   arch,
 			Path:   name,
 			Size:   info.Size(),
 			SHA256: digest,
 		})
 	}
+	for _, asset := range opts.Assets {
+		asset = strings.TrimSpace(asset)
+		if asset == "" {
+			return nil, errors.New("asset path is required")
+		}
+		if err := safeArtifactPath(asset); err != nil {
+			return nil, fmt.Errorf("asset %s: %w", asset, err)
+		}
+		info, digest, err := fileDigest(filepath.Join(distDir, filepath.FromSlash(asset)))
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", asset, err)
+		}
+		manifest.Artifacts = append(manifest.Artifacts, Artifact{
+			Name:   path.Base(asset),
+			Type:   ArtifactAsset,
+			Path:   asset,
+			Size:   info.Size(),
+			SHA256: digest,
+		})
+	}
 	sort.Slice(manifest.Artifacts, func(i, j int) bool {
 		return manifest.Artifacts[i].Path < manifest.Artifacts[j].Path
 	})
@@ -211,6 +237,7 @@ func Verify(opts VerifyOptions) (*VerificationReport, error) {
 		}
 		result := ArtifactVerification{
 			Name:   artifact.Name,
+			Type:   artifact.Type,
 			OS:     artifact.OS,
 			Arch:   artifact.Arch,
 			Path:   artifact.Path,
@@ -224,6 +251,12 @@ func Verify(opts VerifyOptions) (*VerificationReport, error) {
 		if artifact.Name == "" {
 			resultError(&result, "name is required")
 		}
+		if artifact.Type == "" {
+			resultError(&result, "type is required")
+		}
+		if artifact.Type == ArtifactBinary && (artifact.OS == "" || artifact.Arch == "") {
+			resultError(&result, "binary artifact requires os and arch")
+		}
 		if _, exists := seen[artifact.Path]; exists {
 			resultError(&result, "duplicate artifact path")
 		}