Skip to main content
Releases live in the public distribution repository, Abhishek-Mallick/warden-dist, tagged vX.Y.Z. That repository carries release archives and checksums and no source: Warden’s source repository is private, and a private repository’s assets cannot be downloaded anonymously. See Homebrew.

​
What a release contains

Each archive holds warden, warden-mcp, the README, LICENSE.md (the terms the binaries are offered under), and THIRD-PARTY-NOTICES.md (the open-source notices their linked libraries require). The container image for the same version is ghcr.io/abhishek-mallick/warden:<version>.

​
Verify a download

Homebrew does this for you: the formula carries the checksum for your platform and refuses an archive that does not match.

​
How releases are built

A pushed tag runs the release workflow:
  1. Four native runners build macOS and Linux binaries for both CPU architectures. Native rather than cross-compiled because Warden links PostgreSQL’s C parser, and a cgo build needs a toolchain for its target.
  2. Each runner runs the binary it just built (warden version) before uploading it, so an archive that cannot execute never reaches a release.
  3. Checksums are computed over the published archives, and the release is created with them in the public distribution repository. The private repository gets a matching tag and release notes with no assets, so the history of what shipped stays with the code that produced it.
  4. Container images are built natively per architecture and merged into one multi-architecture tag. On the first release the package must be made public by hand, once — GitHub has no API for package visibility.
  5. The Homebrew formula is rendered from the release’s own checksums and pushed to the tap. If the tap token is missing, the release stands and the formula step is skipped with a message.
Everything is reproducible from the repository: scripts/brew-formula.sh renders the formula, and .github/workflows/release.yml is the whole pipeline.

​
Versioning

Pre-1.0, and the surface that may change is called out in the offerings overview:
  • Stable: the HTTP API shapes, the policy file, the configuration file, and the certification contract.
  • Unstable: every internal/ package, and details of the operator view.
Not signed or notarised yet. Binaries carry no code signature, so macOS Gatekeeper may complain about one downloaded through a browser. Homebrew installs are unaffected. Signing and provenance attestation are on the roadmap.