fix: release workflow - add shell:bash, limit build to ubuntu, fix gosec

jongio · Copilot · jongio · commit 681d3c917acf · 2026-03-16T11:36:51.000-07:00
- Add shell: bash to prevent GOOS= syntax failures on Windows runners
- Restrict cross-compilation build+upload to ubuntu-latest only
- Avoid upload-artifact v7 name collision across matrix runners

Co-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -126,6 +126,7 @@ jobs:
           cache-dependency-path: cli/go.sum
 
       - name: Build for multiple platforms
+        if: matrix.os == 'ubuntu-latest'
         run: |
           mkdir -p bin/windows-amd64 bin/linux-amd64 bin/darwin-amd64 bin/darwin-arm64
           GOOS=windows GOARCH=amd64 go build -o bin/windows-amd64/exec.exe ./src/cmd/exec
@@ -134,6 +135,7 @@ jobs:
           GOOS=darwin GOARCH=arm64 go build -o bin/darwin-arm64/exec ./src/cmd/exec
 
       - name: Upload artifacts
+        if: matrix.os == 'ubuntu-latest'
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: binaries
