ci(cd): normalize and align CD pipeline (#90)

[nanotaboada]

Summary

• Rename deploy job to release; drop name: from both jobs
• Add id-token: write and attestations: write permissions to release
• Replace git branch -r --contains with git merge-base --is-ancestor for tag reachability
• Rename step id extract_tag → version and update all references
• Add linux/arm64 to build platforms; set provenance: mode=max
• Add id: push to Docker build step and attest with actions/attest-build-provenance@v4.1.0
• Add --no-merges to changelog git log command
• Add empty changelog guard with distinct messages for first release vs re-tag
• Remove changelog.txt write; drop Quick Start section from release body

Test plan

• CI passes on this branch
• No regressions in test or release job structure
• Verify actions/attest-build-provenance@v4.1.0 step is valid on next tagged release

Closes #90

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

• New Features

  • Docker images now support ARM64 architecture in addition to AMD64.
  • Added build provenance attestation for enhanced security verification.

• Chores

  • Updated CI action versions and improved changelog generation for releases.
  • Removed Quick Start section from release documentation.

[coderabbitai]

Walkthrough

Updated GitHub Actions CD workflow to normalize job structure, support multi-platform Docker builds for both amd64 and arm64 architectures, enable build provenance attestation, standardize changelog generation by excluding merge commits, and update action versions and step references accordingly.

Changes

Cohort / File(s)

Summary

GitHub Actions CI/CD Workflow .github/workflows/rust-cd.yml

Updated action versions (actions/checkout v6.0.2 → v6); renamed deploy job to release; changed tag extraction step id from extract_tag to version and updated all downstream references; replaced git branch reachability check with git merge-base --is-ancestor; added linux/arm64 platform support alongside linux/amd64; switched provenance from false to mode=max; added id-token: write and attestations: write job permissions; added actions/attest-build-provenance@v4.1.0 step for build attestation; enhanced changelog generation with --no-merges flag and empty-changelog guards (No new changes since $TAG / No changes (first release)); removed Quick Start section from release notes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Assessment against linked issues

Objective	Addressed	Explanation
Normalize job structure by removing name: fields and renaming deploy to release [#90]	✅
Update action versions and tag reachability check normalization [#90]	✅
Add multi-platform support (linux/amd64 + linux/arm64) and build provenance attestation [#90]	✅
Tighten changelog generation by excluding merges and adding empty-changelog guards [#90]	✅

Possibly related issues

• #581: Same CD workflow modifications applied to a similar repository—renaming step ids, adding arm64 platform support, enabling provenance attestation, and updating changelog logic.
• #314: Parallel CD workflow updates across different tech stack repositories implementing identical multi-platform Docker builds and provenance/attestation changes.
• #249: Identical CD pipeline normalization changes applied to another repository's workflow file.
• #465: Related CD workflow improvements including multi-platform Docker support and provenance/attestation updates.
• #564: Similar GitHub Actions release workflow enhancements for multi-platform builds and attestation enablement.

Possibly related PRs

• PR #59: Introduced the initial tag-based CD workflow for this repository; this PR refines and updates that workflow with multi-platform support, provenance attestation, and improved changelog generation.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title follows Conventional Commits format (ci:), is descriptive and specific about normalizing and aligning the CD pipeline, and is well under 80 characters (45 characters).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/normalize-cd-pipeline

• 🛠️ sync documentation: Commit on current branch
• 🛠️ sync documentation: Create PR
• 🛠️ enforce http error handling: Commit on current branch
• 🛠️ enforce http error handling: Create PR
• 🛠️ idiomatic review: Commit on current branch
• 🛠️ idiomatic review: Create PR
• 🛠️ verify api contract: Commit on current branch
• 🛠️ verify api contract: Create PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/rust-cd.yml (1)

22-22: Consider consistent version pinning strategy.

The checkout action uses major version @v6 while other actions use pinned versions (e.g., actions/cache@v5.0.4, docker/login-action@v4.1.0). This is acceptable but creates inconsistency. Major version tags auto-update to latest patches, which is convenient but slightly reduces reproducibility.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/rust-cd.yml at line 22, The workflow currently references
actions/checkout with a major tag ("uses: actions/checkout@v6") which is
inconsistent with other actions pinned to exact versions; update the checkout
usage to a pinned release (e.g., replace "actions/checkout@v6" with a specific
patch tag like "actions/checkout@v6.1.0" or whichever exact release you want) so
it matches the repo's explicit-version strategy and improves reproducibility;
ensure the modified string appears where "uses: actions/checkout@v6" is defined.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/rust-cd.yml:
- Line 22: The workflow currently references actions/checkout with a major tag
("uses: actions/checkout@v6") which is inconsistent with other actions pinned to
exact versions; update the checkout usage to a pinned release (e.g., replace
"actions/checkout@v6" with a specific patch tag like "actions/checkout@v6.1.0"
or whichever exact release you want) so it matches the repo's explicit-version
strategy and improves reproducibility; ensure the modified string appears where
"uses: actions/checkout@v6" is defined.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 80f1346c-8df5-4e96-8516-329a14af789e

📥 Commits

Reviewing files that changed from the base of the PR and between 70e1f68 and b2fe4be.

📒 Files selected for processing (1)

• .github/workflows/rust-cd.yml

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.33%. Comparing base (70e1f68) to head (b2fe4be).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #91   +/-   ##
=======================================
  Coverage   84.33%   84.33%           
=======================================
  Files           6        6           
  Lines         166      166           
=======================================
  Hits          140      140           
  Misses         26       26           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.