go-bananas/goreleaser.yaml

# GoReleaser configuration.
#
# The binary is fully static (CGO_ENABLED=0), so every target is a plain file with
# no runtime dependency. That makes the archives boring on purpose: the only thing
# a consumer needs is the binary and, optionally, the frontend assets.
#
# The frontend assets are built inside the Dockerfile rather than here, so the
# released container image and a local `docker build` are byte-for-byte the same
# artefact. Goreleaser handles the standalone binaries, which are for people
# running the service without a container at all.

version: 2

project_name: go-bananas

before:
  hooks:
    - go mod download
    - go mod verify
    # The release image ships the admin UI and the runtime SDK, so they have to
    # exist before the Docker build. `npm ci` rather than `install`, because the
    # lockfile is the point: a release that silently resolved different dependency
    # versions from the ones CI tested would not be the artefact that was signed.
    - npm --prefix web ci --no-audit --no-fund
    - npm --prefix web run build
    - npm --prefix sdk ci --no-audit --no-fund
    - npm --prefix sdk run build

builds:
  - id: go-bananas
    main: ./cmd/go-bananas
    binary: go-bananas
    env:
      # Pure Go throughout: modernc.org/sqlite needs no cgo, so the binary has no
      # libc dependency and cross-compilation is trivial.
      - CGO_ENABLED=0
    flags:
      - -trimpath
    ldflags:
      - -s -w
      - -X github.com/urpi/go-bananas/internal/app.Version={{ .Version }}
      - -X github.com/urpi/go-bananas/internal/app.Commit={{ .FullCommit }}
      - -X github.com/urpi/go-bananas/internal/app.BuildDate={{ .Date }}
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
    goarm: ["7"]
    ignore:
      # Windows on arm64 has no meaningful server use, and the darwin/arm64 build
      # is only useful for local development.
      - goos: windows
        goarch: arm64
      - goos: darwin
        goarch: arm64
    mod_timestamp: "{{ .CommitTimestamp }}"

archives:
  - id: default
    ids: [go-bananas]
    formats: [tar.gz]
    format_overrides:
      - goos: windows
        formats: [zip]
    name_template: >-
      {{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}
      {{- with .Arm }}v{{ . }}{{ end }}
    files:
      - LICENSE
      - README.md
      - docs/**/*
      - src: internal/store/migrations/*.sql
        dst: migrations
      # The built admin UI is not embedded in the binary, so a standalone run needs
      # to be told where it is. Shipping the directory keeps `go-bananas` usable
      # outside a container.
      - src: web/dist/**
        dst: web
      - src: sdk/dist/**
        dst: sdk

checksum:
  name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt"
  algorithm: sha256

snapshot:
  version_template: "{{ incpatch .Version }}-next"

changelog:
  sort: asc
  filters:
    exclude:
      - "^docs:"
      - "^test:"
      - "^chore:"
      - "^ci:"
      - Merge pull request
      - Merge branch
  groups:
    - title: Features
      regexp: '^feat(\(.+\))?!?:'
    - title: Fixes
      regexp: '^fix(\(.+\))?!?:'
    - title: Security
      regexp: '^(security|sec)(\(.+\))?!?:'
    - title: Dependencies
      regexp: '^(build|ci|chore)(\(.+\))?!?:' 

sboms:
  - id: default
    # CycloneDX is the format most vulnerability scanners understand out of the box.
    cmd: syft
    args: ["dir:.", "-o", "cyclonedx-json={{ .ArtifactName }}.sbom.json"]
    artifacts: archive

signs:
  - id: default
    # Cosign with keyless OIDC: no long-lived signing key to protect or rotate.
    cmd: cosign
    certificate: "${artifact}.pem"
    args:
      - sign-blob
      - "--output-certificate=${certificate}"
      - "--output-signature=${signature}"
      - "${artifact}"
      - "--yes"
    env:
      - COSIGN_EXPERIMENTAL=1
    artifacts: archive
    # Signing only runs where a keyless identity is available; a fork's release
    # job has none, and a failed sign should not fail the whole release.
    ids: ["default"]

release:
  prerelease: auto
  # Draft by default. A published container image or a pushed tag is very hard to
  # walk back, so the final promotion is a deliberate human action.
  draft: false
  footer: |
    ## Installation

    ```bash
    helm install go-bananas oci://ghcr.io/urpi/charts/go-bananas --version {{ .Version }}
    ```

    ## Verification

    ```bash
    cosign verify-blob \\
      --certificate {{ .ArtifactName }}.pem \\
      --signature {{ .ArtifactName }}.sig \\
      {{ .ArtifactName }}
    ```

dockers:
  - id: amd64
    ids: [go-bananas]
    goos: linux
    goarch: amd64
    dockerfile: Dockerfile.release
    image_templates:
      - "ghcr.io/urpi/go-bananas:{{ .Version }}-amd64"
    extra_files:
      - web/dist
      - sdk/dist
    build_flag_templates:
      - "--platform=linux/amd64"
      - "--build-arg=TARGETARCH=amd64"
      - "--build-arg=VERSION={{ .Version }}"
      - "--build-arg=COMMIT={{ .FullCommit }}"
      - "--build-arg=BUILD_DATE={{ .Date }}"

  - id: arm64
    ids: [go-bananas]
    goos: linux
    goarch: arm64
    dockerfile: Dockerfile.release
    image_templates:
      - "ghcr.io/urpi/go-bananas:{{ .Version }}-arm64"
    extra_files:
      - web/dist
      - sdk/dist
    build_flag_templates:
      - "--platform=linux/arm64"
      - "--build-arg=TARGETARCH=arm64"
      - "--build-arg=VERSION={{ .Version }}"
      - "--build-arg=COMMIT={{ .FullCommit }}"
      - "--build-arg=BUILD_DATE={{ .Date }}"

docker_manifests:
  - name_template: "ghcr.io/urpi/go-bananas:{{ .Version }}"
    image_templates:
      - "ghcr.io/urpi/go-bananas:{{ .Version }}-amd64"
      - "ghcr.io/urpi/go-bananas:{{ .Version }}-arm64"