wtctl: install, version and release

wtctl is the Watchtower command line client. It handles source map and debug file upload, release markers, JUnit and Test Impact Analysis in CI, as-code apply/diff and the MCP proxy. It is published from go/wtctl to the public repository watchtowerobservability/watchtower-cli (scripts/go-mirror.sh watchtower-cli ./wtctl). Each v* tag there builds a GitHub Release (publish/watchtower-cli/.github/workflows/release.yml).

Install

In CI (GitHub Actions, Linux):

- run: |
    base=https://github.com/watchtowerobservability/watchtower-cli/releases/latest/download
    curl -fsSLO "$base/wtctl_linux_amd64" && curl -fsSLO "$base/SHA256SUMS"
    grep " wtctl_linux_amd64\$" SHA256SUMS | sha256sum -c -
    install -m 0755 wtctl_linux_amd64 /usr/local/bin/wtctl && wtctl version

Pin a version by replacing latest/download with download/v0.2.0. Verify provenance with gh attestation verify wtctl_linux_amd64 --repo watchtowerobservability/watchtower-cli.

Version and updates

• wtctl version prints the release version (stamped at build time with -X main.Version), the OS/arch and the Go version. wtctl --version does the same.

• wtctl version --check compares that version with the latest GitHub release. $WTCTL_RELEASES_API overrides the lookup URL, for example for a GitHub Enterprise mirror.

• wtctl self-update downloads wtctl_<os>_<arch>[.exe] from the latest release, checks it against that release's SHA256SUMS, and only then replaces the running binary. On Windows, the old binary is kept as wtctl.exe.old. --url or $WTCTL_UPDATE_URL points it at another release location (https only). Binaries installed by Homebrew, Scoop or npm should be updated with that package manager.

Releasing (maintainers)

1. Add a section to publish/watchtower-cli/CHANGELOG.md.

2. Run scripts/go-mirror.sh watchtower-cli ./wtctl. It refuses packages outside publish/watchtower-cli/allow.txt and pushes a history-free snapshot.

3. Tag the mirror: git -C <mirror checkout> tag v0.2.0 && git push origin v0.2.0. The workflow then:

   • tests,

   • cross-builds the six binaries with the version stamped and checks wtctl version prints it,

   • writes SHA256SUMS and a Scoop wtctl.json with the real hashes,

   • attests build provenance,

   • creates the GitHub Release with every file attached,

   • updates the Homebrew tap (when the TAP_TOKEN secret is set),

   • publishes the npm wrapper.

This is the same flow as the agent (publish/watchtower-agent, released as v0.1.2).