Harden Midtrans CLI for public release review

.github/workflows/ci.yml

@@ -15,8 +15,10 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: "1.26.5"
           cache: true
@@ -34,8 +36,10 @@ jobs:
           - {goos: linux, goarch: amd64}
           - {goos: windows, goarch: amd64}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: "1.26.5"
       - run: mkdir -p dist
@@ -48,8 +52,46 @@ jobs:
   source-drift:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: "1.26.5"
       - run: go run ./tools/source-drift --baseline contracts/public-sources-v1.json
+
+  release-package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version: "1.26.5"
+          cache: true
+      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          syft-version: v1.42.3
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: v2.17.0
+          args: release --snapshot --clean --skip=sign
+      - run: ./tools/check_release_artifacts.sh
+
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version: "1.26.5"
+          cache: true
+      - run: go mod tidy -diff
+      - run: go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
+      - run: go run github.com/zricethezav/gitleaks/v8@v8.30.1 git --no-banner --redact --exit-code 1
+      - run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -color=false

.github/workflows/release.yml

@@ -13,23 +13,32 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v6
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: "1.26.5"
           cache: true
-      - run: go run ./tools/source-drift --baseline contracts/public-sources-v1.json
-      - uses: sigstore/cosign-installer@v4.1.2
-      - uses: anchore/sbom-action/download-syft@v0.24.0
-      - uses: goreleaser/goreleaser-action@v7.2.3
+      - run: ./tools/check_release.sh
+      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          syft-version: v1.42.3
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: v2.17.0
+          args: release --snapshot --clean --skip=sign
+      - run: ./tools/check_release_artifacts.sh
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: v3.0.6
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           version: v2.17.0
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
-      - uses: actions/attest-build-provenance@v4.1.1
+      - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: dist/checksums.txt

.gitignore

@@ -1,5 +1,7 @@
 /dist/
 /midtrans
+/.superpowers/
+/docs/superpowers/
 **/__pycache__/
 **/*.pyc
 /evaluations/fixtures/*/.state/

.gitleaksignore

@@ -0,0 +1,7 @@
+# Reviewed synthetic fixtures. These fingerprints suppress only the exact
+# historical findings; new copies or changed values must be reviewed again.
+cf7e97f80498a1701fff05395aa424d48cffbcbc:testdata/bisnap/private_key_pkcs8.pem:private-key:1
+17d9d8b965481a395f530f79c5bb046c5991bc03:testdata/coreapi/card-3ds.json:generic-api-key:6
+17d9d8b965481a395f530f79c5bb046c5991bc03:testdata/coreapi/otc-alfamart.json:generic-api-key:6
+ec058bf65621cb4f776b8a971088b7db1ed8b04c:testdata/snap/notification-settlement.json:generic-api-key:7
+38f7dae19f0122da9bf77adc38d1c3dddc228c60:docs/superpowers/plans/2026-07-23-midtrans-cli-foundation-snap.md:generic-api-key:2955

.goreleaser.yaml

@@ -7,6 +7,9 @@ release:
     owner: veritrans
     name: midtrans-cli
 
+source:
+  enabled: true
+
 builds:
   - id: midtrans
     main: ./cmd/midtrans
@@ -52,16 +55,5 @@ signs:
       - "--yes"
     artifacts: checksum
 
-homebrew_casks:
-  - name: midtrans
-    binaries: [midtrans]
-    directory: Casks
-    homepage: https://github.com/veritrans/midtrans-cli
-    description: Sandbox-first Midtrans integration verification CLI for merchants and AI agents
-    repository:
-      owner: veritrans
-      name: homebrew-midtrans
-      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
-
 changelog:
   use: git