Fix/verify version prefix (#10)

* fix: handle version strings without v prefix in --verify

GoReleaser's {{ .Version }} strips the v prefix (e.g. "1.3.0" not
"v1.3.0"), causing checksumURL to generate an invalid GitHub release
URL. Normalize both the tag (always add v) and the dev build check
to handle either format.

* fix: use git-cliff --latest for release notes instead of full changelog

Author: hi-lei

.github/workflows/release.yml

@@ -46,7 +46,11 @@ jobs:
           install-only: true
 
       - name: Generate changelog
-        run: make changelog VERSION=${{ github.event.inputs.version }}
+        run: |
+          # Full changelog for CHANGELOG.md (committed to repo)
+          make changelog VERSION=${{ github.event.inputs.version }}
+          # Release notes for this version only (passed to goreleaser)
+          git-cliff --tag ${{ github.event.inputs.version }} --latest --strip header -o RELEASE_NOTES.md
 
       - name: Commit, tag, and push release branch
         run: |
@@ -67,7 +71,7 @@ jobs:
       - name: Build and release with goreleaser
         uses: goreleaser/goreleaser-action@v6
         with:
-          args: release --clean
+          args: release --clean --release-notes RELEASE_NOTES.md
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
 

.goreleaser.yml

@@ -31,3 +31,6 @@ archives:
 
 checksum:
   name_template: verda_{{ .Version }}_SHA256SUMS
+
+changelog:
+  disable: true

internal/verda-cli/cmd/version/verify.go

@@ -27,9 +27,10 @@ type VerifyResult struct {
 // checksumURL returns the GitHub release URL for the checksums file.
 func checksumURL(ver string) string {
 	bare := strings.TrimPrefix(ver, "v")
+	tag := "v" + bare // GitHub release tags always have v prefix
 	return fmt.Sprintf(
 		"https://github.com/verda-cloud/verda-cli/releases/download/%s/verda_%s_binary_SHA256SUMS",
-		ver, bare,
+		tag, bare,
 	)
 }
 
@@ -133,8 +134,9 @@ func verifyBinary(client *http.Client, binPath, url, goos, goarch string) (*Veri
 // runVerify is the top-level verify logic, writing output to out and warnings
 // to errOut. It uses the provided HTTP client for fetching checksums.
 func runVerify(out, errOut io.Writer, outputFormat string, client *http.Client, ver, goos, goarch string) error {
-	if ver == "v0.0.0-dev" {
-		_, _ = fmt.Fprintln(errOut, "Warning: cannot verify a development build (v0.0.0-dev)")
+	bare := strings.TrimPrefix(ver, "v")
+	if bare == "0.0.0-dev" || bare == "" {
+		_, _ = fmt.Fprintf(errOut, "Warning: cannot verify a development build (%s)\n", ver)
 		return errors.New("cannot verify development build")
 	}
 

internal/verda-cli/cmd/version/verify_test.go

@@ -189,6 +189,10 @@ func TestChecksumURL(t *testing.T) {
 			version: "v0.5.0",
 			want:    "https://github.com/verda-cloud/verda-cli/releases/download/v0.5.0/verda_0.5.0_binary_SHA256SUMS",
 		},
+		{
+			version: "1.3.0",
+			want:    "https://github.com/verda-cloud/verda-cli/releases/download/v1.3.0/verda_1.3.0_binary_SHA256SUMS",
+		},
 	}
 
 	for _, tt := range tests {
@@ -304,13 +308,26 @@ func TestVerifyBinaryMismatch(t *testing.T) {
 func TestRunVerifyDevBuild(t *testing.T) {
 	t.Parallel()
 
-	var outBuf, errBuf bytes.Buffer
-
-	err := runVerify(&outBuf, &errBuf, "", nil, "v0.0.0-dev", "", "")
-	if err == nil {
-		t.Fatal("expected error for dev build")
+	tests := []struct {
+		name    string
+		version string
+	}{
+		{"with v prefix", "v0.0.0-dev"},
+		{"without v prefix", "0.0.0-dev"},
+		{"empty", ""},
 	}
-	if !strings.Contains(errBuf.String(), "development build") {
-		t.Errorf("expected warning about development build, got: %q", errBuf.String())
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			var outBuf, errBuf bytes.Buffer
+			err := runVerify(&outBuf, &errBuf, "", nil, tt.version, "", "")
+			if err == nil {
+				t.Fatal("expected error for dev build")
+			}
+			if !strings.Contains(errBuf.String(), "development build") {
+				t.Errorf("expected warning about development build, got: %q", errBuf.String())
+			}
+		})
 	}
 }