ci: migrate releases to shared pipeline

.github/workflows/release-unified.yml

@@ -0,0 +1,36 @@
+name: Release (unified)
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: SemVer to release
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  release:
+    permissions:
+      actions: read
+      checks: read
+      contents: write
+      pull-requests: write
+      statuses: read
+    uses: openclaw/release-workflows/.github/workflows/release-go-cli.yml@v1
+    with:
+      version: ${{ inputs.version }}
+      repository-type: openclaw
+      checksum-filename: checksums.txt
+      nfpm: disabled
+      stable-identifier: org.openclaw.crawlctl
+      require-signed-tag: true
+      darwin-universal: disabled
+      ci-check-events: '["push","pull_request"]'
+    secrets:
+      MACOS_SIGNING_P12: ${{ secrets.MACOS_SIGNING_P12 }}
+      MACOS_SIGNING_P12_PASSWORD: ${{ secrets.MACOS_SIGNING_P12_PASSWORD }}
+      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+      ASC_PRIVATE_KEY_P8: ${{ secrets.ASC_PRIVATE_KEY_P8 }}

.gitignore

@@ -6,5 +6,4 @@ coverage.out
 *.db-wal
 .DS_Store
 .crabbox/
-.mac-release.env
 /dist/

.goreleaser.yaml

@@ -0,0 +1,32 @@
+version: 2
+
+project_name: crawlkit
+
+changelog:
+  disable: true
+
+builds:
+  - id: crawlctl
+    main: ./cmd/crawlctl
+    binary: crawlctl
+    flags:
+      - -trimpath
+    env:
+      - CGO_ENABLED=0
+    ldflags:
+      - -s -w -X main.version={{ .Version }}
+    targets:
+      - darwin_amd64
+      - darwin_arm64
+      - linux_amd64
+      - linux_arm64
+
+archives:
+  - ids:
+      - crawlctl
+    formats:
+      - tar.gz
+    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+
+checksum:
+  name_template: checksums.txt

CHANGELOG.md

@@ -2,10 +2,16 @@
 
 ## v0.14.4 - Unreleased
 
+### Breaking release asset rename
+
+- Replace `crawlctl-v0.14.3-macos-arm64.tar.gz` with `crawlkit_0.14.4_darwin_arm64.tar.gz` and `crawlctl-v0.14.3-macos-x86_64.tar.gz` with `crawlkit_0.14.4_darwin_amd64.tar.gz`. The new fleet-standard names use the repository prefix, omit the `v` inside filenames, use `darwin` and `amd64`, and replace per-asset `.sha256` sidecars with one `checksums.txt`; scripts that download the old names must be updated.
+- Add fleet-standard `crawlkit_0.14.4_linux_arm64.tar.gz` and `crawlkit_0.14.4_linux_amd64.tar.gz` archives containing the `crawlctl` executable.
+
+### Maintenance
+
 - Update Go dependencies, including `go-runewidth` v0.0.27 and `x/crypto` v0.54.0, and refresh Actions Checkout to v7.0.1 and CodeQL Action to v4.37.3.
 - Standardize local build, check, snapshot, and fail-closed release commands under the shared crawler Makefile contract.
-
-## Unreleased
+- Move official publication to the shared signed, notarized, independently verified GitHub Actions pipeline while preserving the `org.openclaw.crawlctl` code-signing identifier.
 
 ## v0.14.3 - 2026-07-17
 

Makefile

@@ -14,8 +14,8 @@ help:
 		'  lint              Run vet, dead-code, and vulnerability checks.' \
 		'  check             Run every local gate enforced by CI.' \
 		'  snapshot          Build a credential-free local snapshot.' \
-		'  release           Build and verify official release artifacts (VERSION=vX.Y.Z).' \
-		'  verify-release    Verify existing release artifacts (VERSION=vX.Y.Z).' \
+		'  release           Refuse local publishing and print the unified workflow command.' \
+		'  verify-release    Verify downloaded fleet release artifacts (VERSION=X.Y.Z).' \
 		'  test-race         Run the Go test suite with the race detector.' \
 		'  test-release      Test the release scripts.' \
 		'  vet               Run go vet (compatibility target).' \
@@ -64,16 +64,19 @@ check: tidy-check fmt lint test test-race test-release
 snapshot: build
 
 release:
-	@test -n "$(VERSION)" || (echo "usage: make release VERSION=vX.Y.Z" >&2; exit 2)
 	@./scripts/package-crawlctl-release.sh "$(VERSION)"
 
 verify-release:
-	@test -n "$(VERSION)" || (echo "usage: make verify-release VERSION=vX.Y.Z" >&2; exit 2)
+	@test -n "$(VERSION)" || (echo "usage: make verify-release VERSION=X.Y.Z" >&2; exit 2)
 	@set -e; \
-	release_commit="$$(./scripts/verify-crawlctl-release-provenance.sh "$(VERSION)")"; \
-	./scripts/verify-crawlctl-release.sh "$(VERSION)" "$$release_commit" \
-		"dist/crawlctl-$(VERSION)-macos-arm64.tar.gz" \
-		"dist/crawlctl-$(VERSION)-macos-x86_64.tar.gz"
+		version="$(VERSION)"; \
+		version="$${version#v}"; \
+		release_commit="$$(./scripts/verify-crawlctl-release-provenance.sh "v$$version")"; \
+		./scripts/verify-crawlctl-release.sh "$$version" "$$release_commit" \
+			"dist/crawlkit_$${version}_darwin_arm64.tar.gz" \
+			"dist/crawlkit_$${version}_darwin_amd64.tar.gz" \
+			"dist/crawlkit_$${version}_linux_arm64.tar.gz" \
+			"dist/crawlkit_$${version}_linux_amd64.tar.gz"
 
 release-artifacts: release
 

README.md

@@ -16,8 +16,8 @@ safe desktop-cache snapshot utilities.
 go get github.com/openclaw/crawlkit@latest
 ```
 
-Beginning with the next release after v0.13.3, macOS users should install or
-update `crawlctl` from the Developer ID-signed release artifact:
+macOS users should install or update `crawlctl` from the Developer ID-signed
+release artifact:
 
 ```bash
 curl -fsSLO https://raw.githubusercontent.com/openclaw/crawlkit/main/scripts/install-crawlctl.sh
@@ -33,7 +33,21 @@ requirement across in-place updates; the separate clean-VM release gate must
 prove that a later same-path build does not trigger a second protected-data
 alert. This contract does not suppress the first-install consent.
 
-Starting with v0.14.0, release binaries also require an Apple online
+Starting with v0.14.4, release assets use the fleet naming convention:
+`crawlkit_<version>_darwin_arm64.tar.gz` and
+`crawlkit_<version>_darwin_amd64.tar.gz`, with one `checksums.txt` file. This is
+a deliberate breaking rename from the v0.14.3
+`crawlctl-v0.14.3-macos-<arch>.tar.gz` archives and their individual `.sha256`
+sidecars. The version in the new filename has no `v` prefix, and Intel uses
+`amd64` instead of `x86_64`. The installer understands the new names.
+
+The same release also provides `crawlkit_<version>_linux_arm64.tar.gz` and
+`crawlkit_<version>_linux_amd64.tar.gz`. Each archive contains the `crawlctl`
+executable; verify it against `checksums.txt` before installation. The bundled
+installer remains macOS-specific because it also enforces the Developer ID
+designated requirement and online notarization ticket.
+
+Starting with v0.14.0, macOS release binaries also require an Apple online
 notarization ticket before packaging and installation. The raw executable and
 ephemeral ZIP submitted to Apple do not support ticket stapling, so verification
 requires network access. Release verification also binds each thin binary's Go
@@ -50,9 +64,9 @@ development, but produces a locally compiled, ad-hoc-signed macOS executable.
 Replacing that executable changes its designated requirement and invalidates
 Full Disk Access grants.
 
-Go packages are published by tagging this repository. GitHub releases also
-carry signed macOS `crawlctl` artifacts. See `docs/publishing.md` for the
-release commands.
+Go packages are published by tagging this repository. GitHub releases carry
+signed macOS and static Linux `crawlctl` artifacts. See `docs/publishing.md`
+for the release commands and exact asset contract.
 See `docs/boundary.md` for the crawlkit-versus-app ownership boundary and
 `docs/remote-contract.md` for the Worker/client split.