ci: use goreleaser (#74)

.devcontainer/Dockerfile

@@ -1,7 +1,7 @@
 # See here for image contents: https://github.com/microsoft/vscode-dev-containers/tree/v0.245.0/containers/go/.devcontainer/base.Dockerfile
 
 # [Choice] Go version (use -bullseye variants on local arm64/Apple Silicon): 1, 1.19, 1.18, 1-bullseye, 1.19-bullseye, 1.18-bullseye, 1-buster, 1.19-buster, 1.18-buster
-ARG VARIANT="1.19-bullseye"
+ARG VARIANT="1.20-bullseye"
 FROM mcr.microsoft.com/vscode/devcontainers/go:0-${VARIANT}
 
 # [Choice] Node.js version: none, lts/*, 18, 16, 14

.github/workflows/deploy-docs.yaml

@@ -9,7 +9,7 @@ on:
       - 'website/**'
 
 jobs:
-  deploy: 
+  deploy:
     name: Deploy docs website to GitHub Pages
     runs-on: ubuntu-latest
     permissions:

.github/workflows/golangci-lint.yml

@@ -19,19 +19,21 @@ on:
     branches:
       - main
       - release-*
-  workflow_dispatch:
-permissions:
-  contents: read
+
+permissions: read-all
+
 jobs:
   golangci:
     name: lint
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v3
+
       - uses: actions/setup-go@v4
         with:
-          go-version: 1.19
-      - uses: actions/checkout@v3
-      - name: golangci-lint
+          go-version: "1.20"
+
+      - name: lint
         uses: golangci/golangci-lint-action@v3
         with:
-          version: latest
+          version: v1.52.0

.github/workflows/release-pr.yml

@@ -0,0 +1,80 @@
+name: Create Release PR
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.0' # run this workflow when a new minor version is published
+  workflow_dispatch:
+    inputs:
+      release_version:
+        description: '🤖 Which version are we creating a release pull request for?'
+        required: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  create-release-pull-request:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Go 1.20
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.20
+
+      - name: Set release version and target branch for vNext
+        if: github.event_name == 'push'
+        run: |
+          TAG="$(echo "${{ github.ref }}" | tr -d 'refs/tags/v')"
+          MAJOR_VERSION="$(echo "${TAG}" | cut -d '.' -f1)"
+          echo "MAJOR_VERSION=${MAJOR_VERSION}" >> ${GITHUB_ENV}
+          MINOR_VERSION="$(echo "${TAG}" | cut -d '.' -f2)"
+          echo "MINOR_VERSION=${MINOR_VERSION}" >> ${GITHUB_ENV}
+
+          # increment the minor version by 1 for vNext
+          echo "NEWVERSION=v${MAJOR_VERSION}.$((MINOR_VERSION+1)).0-beta.0" >> ${GITHUB_ENV}
+          # pre-release is always being merged to the main branch
+          echo "TARGET_BRANCH=main" >> ${GITHUB_ENV}
+
+      - name: Set release version and target branch from input
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          NEWVERSION="${{ github.event.inputs.release_version }}"
+          echo "${NEWVERSION}" | grep -E '^v[0-9]+\.[0-9]+\.[0-9](-(beta|rc)\.[0-9]+)?$' || (echo "release_version should be in the format vX.Y.Z, vX.Y.Z-beta.A, or vX.Y.Z-rc.B" && exit 1)
+
+          echo "NEWVERSION=${NEWVERSION}" >> ${GITHUB_ENV}
+          MAJOR_VERSION="$(echo "${NEWVERSION}" | cut -d '.' -f1 | tr -d 'v')"
+          MINOR_VERSION="$(echo "${NEWVERSION}" | cut -d '.' -f2)"
+
+          # non-beta releases should always be merged to release branches
+          echo "TARGET_BRANCH=release-${MAJOR_VERSION}.${MINOR_VERSION}" >> ${GITHUB_ENV}
+
+          # beta releases should always be merged to main
+          if [[ "${NEWVERSION}" =~ "beta" ]]; then
+            echo "TARGET_BRANCH=main" >> ${GITHUB_ENV}
+          fi
+
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+        with:
+          fetch-depth: 0
+
+      - name: Create release branch if needed
+        run: |
+          git checkout "${TARGET_BRANCH}" && exit 0
+
+          # Create and push release branch if it doesn't exist
+          git checkout -b "${TARGET_BRANCH}"
+          git push --set-upstream origin "${TARGET_BRANCH}"
+
+      - run: make release-manifest
+
+      - if: github.event_name == 'push'
+        run: make version-docs NEWVERSION=v${MAJOR_VERSION}.${MINOR_VERSION}.x
+
+      - name: Create release pull request
+        uses: peter-evans/create-pull-request@v4
+        with:
+          commit-message: "chore: Prepare ${{ env.NEWVERSION }} release"
+          title: "chore: Prepare ${{ env.NEWVERSION }} release"
+          branch: "release-${{ env.NEWVERSION }}"
+          base: "${{ env.TARGET_BRANCH }}"

.github/workflows/release.yml

@@ -1,75 +1,30 @@
 name: Publish release
+
 on:
-  workflow_dispatch:
+  push:
+    tags:
+      - v*
+
 jobs:
   release:
     runs-on: ubuntu-latest
     permissions:
-      packages: write
       contents: write
     steps:
-      - name: Validate release branch name
-        run: |
-          echo "Publish release invoked on $GITHUB_REF_NAME ..."
-          set +e
-          BASE_BRANCH=$(echo "$GITHUB_REF_NAME" | grep -E '^(main|release-[0-9]+\.[0-9]+)$')
-          if [ -z "$BASE_BRANCH" ]; then echo "Release workflow must be run on \`main\` or \`release-X.Y\` branches ..."; exit 1;
-          else echo "BASE_BRANCH=$BASE_BRANCH" >> $GITHUB_ENV;
-          fi
-      - name: Check out repo
-        uses: actions/checkout@v3
-      - name: Calculate new version number
-        uses: go-semantic-release/action@1b14387401a1c3b588c807afd4ba4a921fd9cc31
-        id: semrel
+      - uses: actions/checkout@v3
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          allow-initial-development-versions: true
-          custom-arguments: '--no-ci'
-          dry: true
-      - name: Validate appropriate base branch for release
-        run: |
-          if [ -z "${{ steps.semrel.outputs.version }}" ]; then
-            echo "No relevant changes found to publish new release against"
-            exit 1
-          fi
-          RELEASE_BRANCH_VER="${{ steps.semrel.outputs.version_major }}.${{ steps.semrel.outputs.version_minor }}"
-          if [ "$BASE_BRANCH" == 'main' ]; then
-            if [ ${{ steps.semrel.outputs.version_patch }} != '0' ]; then
-              echo "Patch revisions should be published off the appropriate release branch, not main"
-              exit 1
-            fi
-            echo "Publishing new release branch ${{ steps.semrel.outputs.version }} from $BASE_BRANCH ..."
-          else
-            BASE_BRANCH_VER="$(echo "$BASE_BRANCH" | grep -Po '(?<=release-)[0-9]+\.[0-9]+$')"
-            if [ "$RELEASE_BRANCH_VER" != "$BASE_BRANCH_VER" ]; then
-              echo "New major/minor versions should be published off main, not an existing release branch"
-              exit 1
-            fi
-            echo "Publishing revision ${{ steps.semrel.outputs.version }} for $BASE_BRANCH ..."
-          fi
-          echo "RELEASE_BRANCH_VER=$RELEASE_BRANCH_VER" >> GITHUB_ENV
-      - name: Set up golang
-        uses: actions/setup-go@v4
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v4
         with:
-          go-version: 1.19
-      - name: Build release
-        run: |
-          CLI_VERSION="${{ steps.semrel.outputs.version }}" make release version-docs
-      - name: Create new semantic release
-        uses: go-semantic-release/action@1b14387401a1c3b588c807afd4ba4a921fd9cc31
+          go-version: "1.20"
+
+      - uses: anchore/sbom-action/download-syft@v0
+
+      - name: Run goreleaser
+        uses: goreleaser/goreleaser-action@v4
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          allow-initial-development-versions: true
-          custom-arguments: '--no-ci'
-      - name: Upload packages
-        uses: AButler/upload-release-assets@c94805dc72e4b20745f543da0f62eaee7722df7a
-        with:
-          files: 'dist/linux_amd64/release/copa_*'
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          release-tag: 'v${{ steps.semrel.outputs.version }}'
-      - name: Create new release branch if needed (idempotent)
-        uses: peterjgrainger/action-create-branch@08259812c8ebdbf1973747f9297e332fa078d3c1
+          version: latest
+          args: release --clean --config .goreleaser.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          branch: release-${{ steps.semrel.outputs.version_major }}.${{ steps.semrel.outputs.version_minor }}

.goreleaser.yml

@@ -0,0 +1,32 @@
+project_name: copacetic
+builds:
+  - id: copacetic
+    goos:
+    - linux
+    goarch:
+    - amd64
+    env:
+      - CGO_ENABLED=0
+      - GO111MODULE=on
+    ldflags: -s -w
+      -X github.com/project-copacetic/copacetic/pkg/version.GitVersion={{.Version}}
+      -X github.com/project-copacetic/copacetic/pkg/version.GitCommit={{.Commit}}
+      -X github.com/project-copacetic/copacetic/pkg/version.BuildDate={{.Date}}
+      -X main.Version=$(.Version)
+      -extldflags "-static"
+    binary: copa
+    hooks: {}
+
+archives:
+  - id: copacetic
+    builds:
+      - copacetic
+    format: tar.gz
+    name_template: "{{ .Binary }}_{{ .Os }}_{{ .Arch }}"
+
+checksum:
+  name_template: "{{ .ProjectName }}_checksums.txt"
+  algorithm: sha256
+
+sboms:
+  - artifacts: archive

Makefile

@@ -17,7 +17,7 @@ CLI_VERSION  ?= edge
 DEBUG        ?= 0
 NODE_VERSION ?= 16-bullseye-slim
 
-# Go build metadata variables 
+# Go build metadata variables
 BASE_PACKAGE_NAME := github.com/project-copacetic/copacetic
 GIT_COMMIT        := $(shell git rev-list -1 HEAD)
 GIT_VERSION       := $(shell git describe --always --tags --dirty)
@@ -37,7 +37,7 @@ endif
 # Build configuration variables
 ifeq ($(DEBUG),0)
   BUILDTYPE_DIR:=release
-  LDFLAGS:="$(DEFAULT_LDFLAGS) -s -w"
+  LDFLAGS:="$(DEFAULT_LDFLAGS) -s -w -extldflags -static"
 else
   BUILDTYPE_DIR:=debug
   LDFLAGS:="$(DEFAULT_LDFLAGS)"
@@ -67,7 +67,7 @@ $(CLI_BINARY):
 .PHONY: lint
 lint:
 	$(info $(INFOMARK) Linting go code ...)
-	golangci-lint run
+	golangci-lint run -v ./...
 
 ################################################################################
 # Target: format                                                               #
@@ -95,6 +95,13 @@ $(ARCHIVE_NAME):
 .PHONY: release
 release: build archive
 
+################################################################################
+# Target: release-manifest                                                     #
+################################################################################
+.PHONY: release-manifest
+release-manifest:
+	@sed -i -e 's/^CLI_VERSION := .*/CLI_VERSION := ${NEWVERSION}/' ./Makefile
+
 ################################################################################
 # Target: test - unit testing                                                  #
 ################################################################################
@@ -129,6 +136,6 @@ version-docs:
 	docker run --rm \
 		-v $(shell pwd)/website:/website \
 		-w /website \
-		$(IDFLAGS) \
+		-u $(shell id -u):$(shell id -g) \
 		node:${NODE_VERSION} \
-		sh -c "yarn install --frozen lockfile && yarn run docusaurus docs:version ${CLI_VERSION}"
+		sh -c "yarn install --frozen lockfile && yarn run docusaurus docs:version ${NEWVERSION}"

pkg/buildkit/buildkit.go

@@ -226,8 +226,5 @@ func SolveToDocker(ctx context.Context, c *client.Client, st *llb.State, configD
 		}
 		return pipeR.Close()
 	})
-	if err := eg.Wait(); err != nil {
-		return err
-	}
-	return nil
+	return eg.Wait()
 }

pkg/patch/patch.go

@@ -128,9 +128,5 @@ func patchWithContext(ctx context.Context, buildkitAddr, image, reportFile, patc
 	if err != nil {
 		return err
 	}
-	if err := buildkit.SolveToDocker(ctx, config.Client, patchedImageState, config.ConfigData, patchedImageName); err != nil {
-		return err
-	}
-
-	return nil
+	return buildkit.SolveToDocker(ctx, config.Client, patchedImageState, config.ConfigData, patchedImageName)
 }

pkg/pkgmgr/rpm.go

@@ -78,7 +78,7 @@ func (st rpmDBType) String() string {
 }
 
 // Depending on go-rpm-version lib for RPM version comparison rules.
-func isValidRPMVersion(v string) bool {
+func isValidRPMVersion(v string) bool { // nolint:revive
 	// TODO: Verify if there are format correctness check that need to be added given lack of support in rpmVer lib
 	return true
 }