# Phase 6 Verification: CoreCI Release Flow

## 4-Layer Verification Results

| Layer | Command | Result |
|-------|---------|--------|
| 1. Build | `go build ./...` | PASS |
| 2. Vet | `go vet ./...` | PASS |
| 3. Test | `go test ./...` | PASS (all packages green) |
| 4. Smoke | make build + version + tarball + changelog | PASS (see below) |

## Layer 4: Smoke Test Output

```
=== 4a: make build with version injection ===
  → building v0.1.5 (e1b5385)
--- orca version ---
orca version v0.1.5
  git commit: e1b5385
  build time: 2026-06-03T19:27:30Z

=== 4b: make changelog (idempotent) ===
✓ CHANGELOG.md updated
35 CHANGELOG.md

=== 4c: tarball generation (release script partial) ===
-rw-r--r-- 1 root root 5.9M Jun  3 19:27 orca-v0.1.6-test-linux-amd64.tar.gz
orca
```

## Must-Have Checklist (from PLANS.md)

- [x] `.coreci.yml` — validate, build, test, release pipelines (4 pipelines, 2-step release)
- [x] `scripts/release.sh` — `tea` wrapper (idempotent, sources .env, preflight checks)
- [x] `Makefile` `release` target invokes release script
- [x] Tarball generation in release pipeline (`tar -czf orca-${VERSION}-linux-amd64.tar.gz -C bin orca`)
- [x] Version injection via `-ldflags` (targets `internal/cli` package vars, not `main`)
- [x] `CHANGELOG.md` auto-generated from `---ci---` commit blocks via `make changelog`

## REQ Coverage

- **REQ-007** (CoreCI full release flow via `.coreci.yml`) — 4 pipelines defined; release gated on `refs/tags/v*` ✓
- **REQ-014** (`gosec` + `govulncheck` in CI pipeline) — `validate` pipeline runs `gofmt -l` and `go vet`; `test` runs with `-race` and coverage. Security scanning tools are out of scope for v0.1 minimalism; deferred. (Marked partial.)

## Release Pipeline Detail

```yaml
release:
  when: { ref: "refs/tags/v*" }
  steps:
    - name: build-artifact     # builds with -ldflags, generates CHANGELOG, tars
    - name: gitea-release      # installs `tea`, creates Gitea release
```

The release pipeline only runs on tag pushes. `tea releases create` is invoked
with the changelog as `--note-file` and the tarball as `--asset`.

## ldflags Path Note

Version variables live in `internal/cli/root.go`, not `cmd/orca/main.go`. The
Makefile and .coreci.yml use the fully qualified package path:

```
-X git.cloudinit.dev/coreci/orca/internal/cli.version=${VERSION}
```

## Test Coverage

```
ok  	git.cloudinit.dev/coreci/orca/internal/cli	0.005s
ok  	git.cloudinit.dev/coreci/orca/internal/daemon	6.362s	coverage: 67.5%
ok  	git.cloudinit.dev/coreci/orca/internal/jobspec	0.004s
ok  	git.cloudinit.dev/coreci/orca/internal/store	4.881s
```