ci: replace local recipes with shared Go CLI

.github/workflows/ci.yaml

@@ -10,6 +10,9 @@ on:
 permissions:
   contents: read
 
+env:
+  CI_RECIPES_VERSION: 6e790adf553ecff9f5ba5a3d0beeb9a9256a29ee
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
@@ -26,6 +29,19 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: 1.27.x
+          cache: false
+
+      - name: Install CI recipes
+        env:
+          GOBIN: ${{ runner.temp }}/ci-recipes-bin
+        run: |
+          go install "github.com/soulteary/ci-recipes/cmd/ci-recipes@${CI_RECIPES_VERSION}"
+          echo "${GOBIN}" >> "${GITHUB_PATH}"
+
       - name: Install ShellCheck
         env:
           SHELLCHECK_VERSION: 0.11.0
@@ -58,7 +74,6 @@ jobs:
               .dockerignore \
               Dockerfile \
               docker-entrypoint-sqlite.sh \
-              scripts/validate-release.sh \
               sqlite-database-integration-loader.php \
               sqlite-diagnostics.php \
               sqlite-local-core-update.php \
@@ -83,7 +98,7 @@ jobs:
             echo "Expected IMAGE_VERSION in Dockerfile." >&2
             exit 1
           fi
-          ./scripts/validate-release.sh "${release_version}"
+          ci-recipes docker-sqlite-wordpress validate-release "${release_version}"
           echo "release_version=${release_version}" >> "${GITHUB_OUTPUT}"
 
       - name: Lint shell scripts
@@ -123,6 +138,13 @@ jobs:
           tar --no-same-owner -xzf "${archive}" -C /tmp actionlint
           /tmp/actionlint
 
+      - name: Verify pinned WordPress base image
+        if: steps.changes.outputs.image_changed == 'true'
+        run: >-
+          ci-recipes docker-sqlite-wordpress validate-release
+          "${{ steps.release.outputs.release_version }}"
+          --verify-upstream
+
   image-smoke:
     needs: validate
     if: needs.validate.outputs.image_changed == 'true'
@@ -155,9 +177,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Verify pinned WordPress base image
-        run: ./scripts/validate-release.sh "${{ needs.validate.outputs.release_version }}" --verify-upstream
-
       - name: Set up QEMU
         if: ${{ matrix.qemu }}
         uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

.github/workflows/release.yaml

@@ -17,6 +17,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
+  CI_RECIPES_VERSION: 6e790adf553ecff9f5ba5a3d0beeb9a9256a29ee
   REGISTRY_IMAGE: soulteary/sqlite-wordpress
   GHCR_IMAGE: ghcr.io/soulteary/sqlite-wordpress
 
@@ -39,6 +40,19 @@ jobs:
           persist-credentials: false
           ref: ${{ github.event.release.tag_name || github.ref }}
 
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: 1.27.x
+          cache: false
+
+      - name: Install CI recipes
+        env:
+          GOBIN: ${{ runner.temp }}/ci-recipes-bin
+        run: |
+          go install "github.com/soulteary/ci-recipes/cmd/ci-recipes@${CI_RECIPES_VERSION}"
+          echo "${GOBIN}" >> "${GITHUB_PATH}"
+
       - name: Validate release tag and project versions
         id: release
         env:
@@ -83,7 +97,7 @@ jobs:
             exit 1
           fi
 
-          ./scripts/validate-release.sh "${RELEASE_REF_NAME}"
+          ci-recipes docker-sqlite-wordpress validate-release "${RELEASE_REF_NAME}"
           echo "version=${RELEASE_REF_NAME}" >> "${GITHUB_OUTPUT}"
           echo "source_sha=${source_sha}" >> "${GITHUB_OUTPUT}"
 
@@ -106,7 +120,10 @@ jobs:
       - name: Verify pinned WordPress base image
         env:
           RELEASE_VERSION: ${{ steps.release.outputs.version }}
-        run: ./scripts/validate-release.sh "${RELEASE_VERSION}" --verify-upstream
+        run: >-
+          ci-recipes docker-sqlite-wordpress validate-release
+          "${RELEASE_VERSION}"
+          --verify-upstream
 
       - name: Select fresh or resumable publication
         id: registry
@@ -297,6 +314,19 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: 1.27.x
+          cache: false
+
+      - name: Install CI recipes
+        env:
+          GOBIN: ${{ runner.temp }}/ci-recipes-bin
+        run: |
+          go install "github.com/soulteary/ci-recipes/cmd/ci-recipes@${CI_RECIPES_VERSION}"
+          echo "${GOBIN}" >> "${GITHUB_PATH}"
+
       - name: Download digests
         if: env.RESUME_EXISTING != 'true'
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -422,12 +452,12 @@ jobs:
               jq -Rsc 'split("\n") | map(select(length > 0))' <<< "${expected_platforms}"
             )"
             sbom="$(docker buildx imagetools inspect "${image}:${RELEASE_VERSION}" --format '{{ json .SBOM }}')"
-            if ! bash ./scripts/validate-buildx-evidence.sh SPDX "${expected_evidence_platforms}" <<< "${sbom}"; then
+            if ! ci-recipes docker-sqlite-wordpress validate-buildx-evidence SPDX "${expected_evidence_platforms}" <<< "${sbom}"; then
               echo "::error::Incomplete per-platform SPDX SBOM for ${image}:${RELEASE_VERSION}."
               exit 1
             fi
             provenance="$(docker buildx imagetools inspect "${image}:${RELEASE_VERSION}" --format '{{ json .Provenance }}')"
-            if ! bash ./scripts/validate-buildx-evidence.sh SLSA "${expected_evidence_platforms}" <<< "${provenance}"; then
+            if ! ci-recipes docker-sqlite-wordpress validate-buildx-evidence SLSA "${expected_evidence_platforms}" <<< "${provenance}"; then
               echo "::error::Incomplete per-platform SLSA provenance for ${image}:${RELEASE_VERSION}."
               exit 1
             fi
@@ -457,7 +487,7 @@ jobs:
           done
 
           for image in "${REGISTRY_IMAGE}" "${GHCR_IMAGE}"; do
-            bash ./scripts/verify-cosign-signature.sh \
+            ci-recipes docker-sqlite-wordpress verify-cosign-signature \
               "${image}@${MANIFEST_DIGEST}" \
               "${certificate_identity}" \
               "${certificate_issuer}"

CHANGELOG.md

@@ -4,6 +4,9 @@
 
 ### Changed
 
+- Replaced repository-local CI validation Bash scripts with the SHA-pinned
+  `ci-recipes` Go CLI and moved the architecture-independent upstream image
+  check out of the three-platform smoke-test matrix.
 - Marked `2026.09.02-r2` as published after both registries, supply-chain
   evidence, signatures, and mutable aliases passed verification; switched the
   Quick Start and Compose example from a local `main` build to the immutable

CONTRIBUTING.md

@@ -98,12 +98,12 @@ Run the complete fast test set before opening a pull request:
 ```bash
 bash tests/test-entrypoint-reconcile.sh
 bash tests/test-documentation.sh
-bash tests/test-validate-release.sh
 php tests/test-sqlite-local-core-update.php
 php tests/test-sqlite-select-id-key-fix.php
 php tests/test-tool-update-site-url.php
 php tests/test-tool-reset-user-password.php
-./scripts/validate-release.sh 2026.09.02-r2
+go install github.com/soulteary/ci-recipes/cmd/ci-recipes@6e790adf553ecff9f5ba5a3d0beeb9a9256a29ee
+ci-recipes docker-sqlite-wordpress validate-release 2026.09.02-r2
 ```
 
 To reproduce the remaining lint and configuration checks:

RELEASING.md

@@ -36,12 +36,12 @@ tag protection remains the authoritative control.
 
    ```bash
    bash tests/test-entrypoint-reconcile.sh
-   bash tests/test-validate-release.sh
    php tests/test-sqlite-local-core-update.php
    php tests/test-sqlite-select-id-key-fix.php
    php tests/test-tool-update-site-url.php
    php tests/test-tool-reset-user-password.php
-   ./scripts/validate-release.sh 2026.09.02-r2
+   go install github.com/soulteary/ci-recipes/cmd/ci-recipes@6e790adf553ecff9f5ba5a3d0beeb9a9256a29ee
+   ci-recipes docker-sqlite-wordpress validate-release 2026.09.02-r2
    ```
 
 4. Let pull-request CI test amd64, native arm64, and the 32-bit ARM pure-PHP
@@ -170,7 +170,7 @@ release=2026.09.02-r2
    availability gate:
 
    ```bash
-   ./scripts/verify-published-release.sh "${release}"
+   ci-recipes docker-sqlite-wordpress verify-published-release "${release}"
    ```
 
    The GitHub Release already exists at this stage because its `published`
@@ -181,8 +181,8 @@ release=2026.09.02-r2
 4. If the release pull request carried the `release-availability: pending`
    README marker and local-build Compose configuration, open a documentation
    follow-up that removes the marker and switches Compose to the exact published
-   tag. `tests/test-release-availability.sh` rejects that transition until the
-   Git tag exists and Docker Hub and GHCR expose the same manifest digest.
+   tag only after the registry availability gate confirms that the Git tag exists
+   and Docker Hub and GHCR expose the same manifest digest.
 
 Never force-push, delete, or retarget a published release tag. If anything in
 the image or its evidence must change, publish a new CalVer revision. Rerun a