Predictable and Immutable Release process on CI

[kensipe]

It was identified that our release process which uses goreleaser does not define the version. Historically it has been "latest". Additionally historically the release build has been on a developers dev box. This additionally challenges the repeatability of the release (indeterministic version of build tools). While the raised issue is the "version" of goreleaser, the real issue to me seems like a repeatable release build chain which includes version of Go, version of goreleaser, version of docker, etc.

Based on that justification, it seems best to build out the release process to be handled through our CI system which will likely require scripts and a build image which will be self-documenting or traceable. We should document anything that falls outside that assumption.

[ANeumann82]

👍 Good points. In the same vein, if it's possible it would be great if we could get reproducible builds

[kensipe]

yep.. I thought that was what was communicated... but yeah!