Enable pre-built binary releases with GoReleaser

[aalmiray]

GoReleaser simplifies creating Git releases and posting binaries as release assets and to package managers such as Homebrew.

Consider posting pre-built binaries for multiple platforms (not just linux-amd64 as it is at the moment).

cc: @goreleaser @caarlos0

[ianlewis]

Thanks. We currently use our own builder workflow which has configuration that is similar to GoReleaser. We could definitely generate binaries for multiple architectures (though I'm not sure about homebrew).

[aalmiray]

GoReleaser usually builds the binaries for you and the posts them to several package managers. However, I believe it's possible to skip the build step (so that you may keep your own build process for security reasons) and instruct GoReleaser to continue with packaging and releasing options.

[suzuki-shunsuke]

google/osv-scanner and aquaproj/aqua build binaries with Goreleaser and generate SLSA Provenance with slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml.

• https://github.com/google/osv-scanner/blob/124ad0e2311dc8f25cec2aa298e467a7fffef3b1/.github/workflows/goreleaser.yml#L28-L53
• https://github.com/aquaproj/aqua/blob/c4660ab22920a21dcc7dc0ccdc8947e15ac38c6f/.github/workflows/release.yaml#L38-L81

These workflows may be useful.

[suzuki-shunsuke]

I've created a pull request.

• chore: release assets for multiple platforms #421

[suzuki-shunsuke]

#434 was merged.
Pre built binaries for each platform (windows, linux, macOS / amd64, arm64) will be released from the next release.

[aalmiray]

This are amazing news and an excellent way to begin the new year! 🙏 @suzuki-shunsuke!

[laurentsimon]

Multiple releases done in #434, thanks you @suzuki-shunsuke
Closing the issue

[suzuki-shunsuke]

v2.1.0 has been released. 🎉
https://github.com/slsa-framework/slsa-verifier/releases/tag/v2.1.0