initial commit

goreleaser.yaml

@@ -0,0 +1,197 @@
+# GoReleaser configuration.
+#
+# The binary is fully static (CGO_ENABLED=0), so every target is a plain file with
+# no runtime dependency. That makes the archives boring on purpose: the only thing
+# a consumer needs is the binary and, optionally, the frontend assets.
+#
+# The frontend assets are built inside the Dockerfile rather than here, so the
+# released container image and a local `docker build` are byte-for-byte the same
+# artefact. Goreleaser handles the standalone binaries, which are for people
+# running the service without a container at all.
+
+version: 2
+
+project_name: go-bananas
+
+before:
+  hooks:
+    - go mod download
+    - go mod verify
+    # The release image ships the admin UI and the runtime SDK, so they have to
+    # exist before the Docker build. `npm ci` rather than `install`, because the
+    # lockfile is the point: a release that silently resolved different dependency
+    # versions from the ones CI tested would not be the artefact that was signed.
+    - npm --prefix web ci --no-audit --no-fund
+    - npm --prefix web run build
+    - npm --prefix sdk ci --no-audit --no-fund
+    - npm --prefix sdk run build
+
+builds:
+  - id: go-bananas
+    main: ./cmd/go-bananas
+    binary: go-bananas
+    env:
+      # Pure Go throughout: modernc.org/sqlite needs no cgo, so the binary has no
+      # libc dependency and cross-compilation is trivial.
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+    ldflags:
+      - -s -w
+      - -X github.com/urpi/go-bananas/internal/app.Version={{ .Version }}
+      - -X github.com/urpi/go-bananas/internal/app.Commit={{ .FullCommit }}
+      - -X github.com/urpi/go-bananas/internal/app.BuildDate={{ .Date }}
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    goarm: ["7"]
+    ignore:
+      # Windows on arm64 has no meaningful server use, and the darwin/arm64 build
+      # is only useful for local development.
+      - goos: windows
+        goarch: arm64
+      - goos: darwin
+        goarch: arm64
+    mod_timestamp: "{{ .CommitTimestamp }}"
+
+archives:
+  - id: default
+    ids: [go-bananas]
+    formats: [tar.gz]
+    format_overrides:
+      - goos: windows
+        formats: [zip]
+    name_template: >-
+      {{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}
+      {{- with .Arm }}v{{ . }}{{ end }}
+    files:
+      - LICENSE
+      - README.md
+      - docs/**/*
+      - src: internal/store/migrations/*.sql
+        dst: migrations
+      # The built admin UI is not embedded in the binary, so a standalone run needs
+      # to be told where it is. Shipping the directory keeps `go-bananas` usable
+      # outside a container.
+      - src: web/dist/**
+        dst: web
+      - src: sdk/dist/**
+        dst: sdk
+
+checksum:
+  name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt"
+  algorithm: sha256
+
+snapshot:
+  version_template: "{{ incpatch .Version }}-next"
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+      - "^chore:"
+      - "^ci:"
+      - Merge pull request
+      - Merge branch
+  groups:
+    - title: Features
+      regexp: '^feat(\(.+\))?!?:'
+    - title: Fixes
+      regexp: '^fix(\(.+\))?!?:'
+    - title: Security
+      regexp: '^(security|sec)(\(.+\))?!?:'
+    - title: Dependencies
+      regexp: '^(build|ci|chore)(\(.+\))?!?:' 
+
+sboms:
+  - id: default
+    # CycloneDX is the format most vulnerability scanners understand out of the box.
+    cmd: syft
+    args: ["dir:.", "-o", "cyclonedx-json={{ .ArtifactName }}.sbom.json"]
+    artifacts: archive
+
+signs:
+  - id: default
+    # Cosign with keyless OIDC: no long-lived signing key to protect or rotate.
+    cmd: cosign
+    certificate: "${artifact}.pem"
+    args:
+      - sign-blob
+      - "--output-certificate=${certificate}"
+      - "--output-signature=${signature}"
+      - "${artifact}"
+      - "--yes"
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    artifacts: archive
+    # Signing only runs where a keyless identity is available; a fork's release
+    # job has none, and a failed sign should not fail the whole release.
+    ids: ["default"]
+
+release:
+  prerelease: auto
+  # Draft by default. A published container image or a pushed tag is very hard to
+  # walk back, so the final promotion is a deliberate human action.
+  draft: false
+  footer: |
+    ## Installation
+
+    ```bash
+    helm install go-bananas oci://ghcr.io/urpi/charts/go-bananas --version {{ .Version }}
+    ```
+
+    ## Verification
+
+    ```bash
+    cosign verify-blob \\
+      --certificate {{ .ArtifactName }}.pem \\
+      --signature {{ .ArtifactName }}.sig \\
+      {{ .ArtifactName }}
+    ```
+
+dockers:
+  - id: amd64
+    ids: [go-bananas]
+    goos: linux
+    goarch: amd64
+    dockerfile: Dockerfile.release
+    image_templates:
+      - "ghcr.io/urpi/go-bananas:{{ .Version }}-amd64"
+    extra_files:
+      - web/dist
+      - sdk/dist
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=TARGETARCH=amd64"
+      - "--build-arg=VERSION={{ .Version }}"
+      - "--build-arg=COMMIT={{ .FullCommit }}"
+      - "--build-arg=BUILD_DATE={{ .Date }}"
+
+  - id: arm64
+    ids: [go-bananas]
+    goos: linux
+    goarch: arm64
+    dockerfile: Dockerfile.release
+    image_templates:
+      - "ghcr.io/urpi/go-bananas:{{ .Version }}-arm64"
+    extra_files:
+      - web/dist
+      - sdk/dist
+    build_flag_templates:
+      - "--platform=linux/arm64"
+      - "--build-arg=TARGETARCH=arm64"
+      - "--build-arg=VERSION={{ .Version }}"
+      - "--build-arg=COMMIT={{ .FullCommit }}"
+      - "--build-arg=BUILD_DATE={{ .Date }}"
+
+docker_manifests:
+  - name_template: "ghcr.io/urpi/go-bananas:{{ .Version }}"
+    image_templates:
+      - "ghcr.io/urpi/go-bananas:{{ .Version }}-amd64"
+      - "ghcr.io/urpi/go-bananas:{{ .Version }}-arm64"