Add GoReleaser-based multi-platform distribution#78
Conversation
|
Warning Review limit reached
Your plan includes 1 review of capacity. Refill in 52 minutes and 28 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThis PR migrates the release pipeline from manual cross-platform Go builds and GitHub artifact uploads to an automated GoReleaser workflow. It introduces a ChangesGoReleaser Release Automation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR migrates the project’s release pipeline from a custom GitHub Actions build/release matrix to a GoReleaser-driven multi-platform distribution, and updates installation docs accordingly.
Changes:
- Add a GoReleaser config to produce archives, checksums, SBOMs, signatures, and OS packages, and publish to Homebrew/Scoop.
- Replace the previous matrix build/release workflow with GoReleaser-based release publishing and a config-check job.
- Add a version-agnostic
install.shand update README installation instructions.
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
README.md |
Updates “Getting Started” with Homebrew/Scoop/install-script/package install paths. |
install.sh |
Adds a curl-pipe-sh installer that downloads a release archive and verifies checksums. |
.goreleaser.yaml |
Introduces GoReleaser v2 config for builds, archives, SBOMs, signing, nfpm packages, and tap/bucket publishing. |
.gitignore |
Ignores GoReleaser dist/ output. |
.github/workflows/go.yml |
Replaces hand-rolled build/release jobs with GoReleaser check + release flow and provenance attestation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/go.yml (1)
3-5:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAdd the missing PR trigger for
goreleaser-check.
goreleaser-checkis gated for PRs, but the workflow only triggers onpush, so PR validation won’t execute.Suggested fix
on: push: + pull_request:Also applies to: 23-24
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/go.yml around lines 3 - 5, The workflow currently triggers only on push; add a pull request trigger so the goreleaser-check job runs on PRs by updating the top of .github/workflows/go.yml: under the existing "on:" section add "pull_request:" (optionally mirroring branches/paths used by "push") so the workflow named or referenced as goreleaser-check will also run for PR events; ensure any branch filters match the push configuration.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/go.yml:
- Around line 23-25: The goreleaser-check job currently inherits default
GITHUB_TOKEN permissions; update the job definition for goreleaser-check to
explicitly scope token permissions to least-privilege by adding a permissions
block (e.g., permissions: contents: read) under the goreleaser-check job so the
check-only path only has read access to repository contents; locate the
goreleaser-check job name in the workflow and add the permissions entry there.
- Around line 27-33: The workflow currently pins actions by mutable tags (e.g.,
actions/checkout@v6, actions/setup-go@v6, goreleaser/goreleaser-action@v6 and
googleapis/release-please-action@v4); update .github/workflows/go.yml to use
immutable 40-hex commit SHAs instead of tags by replacing each uses: entry
(actions/checkout, actions/setup-go, goreleaser/goreleaser-action,
googleapis/release-please-action) with the corresponding repository commit SHA
(fetch the latest recommended SHA from each action's GitHub repo or release
notes) so the workflow is deterministically pinned, then commit the updated
go.yml and run the workflow to verify.
- Around line 27-29: Update both GitHub Actions checkout steps that use "uses:
actions/checkout@v6" to explicitly disable credential persistence by adding
persist-credentials: false to their step inputs; locate the two checkout steps
(the one currently specifying fetch-depth: 0 and the other similar step later)
and add persist-credentials: false alongside fetch-depth to prevent the runner
from storing the auth token in git config.
In `@install.sh`:
- Line 28: The installer currently maps "armv6l" into the arm build by matching
the case branch 'armv7l | armv6l | arm) arch="arm" ;;' which may install an
incompatible ARMv7 (GOARM=7) binary on ARMv6 devices; update the install.sh case
handling so that 'armv7l | arm) arch="arm" ;;' remains for supported ARMv7
targets and add an explicit 'armv6l' branch that prints a clear error message
and exits (referring to the 'arch' variable and the case branch in install.sh)
to refuse installation on ARMv6. Ensure the error explains the binary requires
ARMv7 (GOARM=7).
In `@README.md`:
- Around line 55-56: Update the README sentence that currently reads "Binaries
are built and signed (cosign + SBOM) on GitHub Actions" to explicitly state what
is signed and what is generated: indicate that the release process signs
checksum artifacts using cosign, that SBOMs are produced and attached separately
(not cosign-signed at the binary level), and mention where users can verify the
signed checksums (e.g., the "releases page" link text). Change the phrasing
around the "releases page" reference to reflect this clarification so readers
won't assume per-binary cosign signatures.
---
Outside diff comments:
In @.github/workflows/go.yml:
- Around line 3-5: The workflow currently triggers only on push; add a pull
request trigger so the goreleaser-check job runs on PRs by updating the top of
.github/workflows/go.yml: under the existing "on:" section add "pull_request:"
(optionally mirroring branches/paths used by "push") so the workflow named or
referenced as goreleaser-check will also run for PR events; ensure any branch
filters match the push configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b0856ecc-ad47-4239-9216-049df10bfa40
📒 Files selected for processing (5)
.github/workflows/go.yml.gitignore.goreleaser.yamlREADME.mdinstall.sh
…y signing wording
Replaces the hand-rolled build/release matrix with GoReleaser: produces archives, checksums, SBOMs, cosign signatures, deb/rpm/apk packages, a Homebrew cask, and a Scoop manifest, and adds a version-agnostic
install.shforcurl | shinstalls. Keeps the existing release-please flow (release.mode: append) and build-provenance attestation.Requires repo secret
TAP_GITHUB_TOKEN(PAT with contents:write on homebrew-tap + scoop-bucket) and atwangodev/scoop-bucketrepo before the next tagged release.Summary by CodeRabbit
New Features
Documentation