Add GoReleaser packaging for release builds #344
Conversation
Packages cross-built binaries into archives and Linux deb/rpm packages while retaining standalone binaries.
Reviewer's GuideIntroduces a GitHub Actions release pipeline that cross-builds Rust binaries for multiple platforms, prepares distribution artifacts, and leverages GoReleaser to package them into tar.gz archives, deb/rpm packages, and generate checksums. Flow diagram for cross-building and packaging process in release workflowflowchart TD
Start([Release Published]) --> Checkout[Checkout Source]
Checkout --> SetupRust[Setup Rust]
SetupRust --> InstallCross[Install cross]
InstallCross --> BuildBinaries[Cross-build Rust binaries]
BuildBinaries --> PrepareDist[Prepare dist folders]
PrepareDist --> SetupGo[Setup Go]
SetupGo --> GoReleaser[Run GoReleaser]
GoReleaser --> Archives[Create tar.gz archives]
GoReleaser --> Packages[Create deb/rpm packages]
GoReleaser --> Checksums[Generate checksums]
Archives --> End([Upload to GitHub Release])
Packages --> End
Checksums --> End
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Warning Rate limit exceeded@leynos has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 6 minutes and 25 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![codescene-delta-analysis[bot]](https://avatars.githubusercontent.com/in/53921?s=60&v=4){kind=small}
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes and they look great!
Blocking issues:
- An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)
Prompt for AI Agents
Please address the comments from this code review:
## Security Issues
### Issue 1
<location> `.github/workflows/release.yml:36` </location>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| with: | ||
| go-version: '1.21' | ||
| - name: Run GoReleaser | ||
| uses: goreleaser/goreleaser-action@v5 |
There was a problem hiding this comment.
security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha): An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
Source: opengrep
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| with: | ||
| go-version: '1.21' | ||
| - name: Run GoReleaser | ||
| uses: goreleaser/goreleaser-action@v5 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
Codex Review: Here are some suggestions.
Reply with @codex fix comments to fix any unresolved comments.
About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".
| - name: Run GoReleaser | ||
| uses: goreleaser/goreleaser-action@v5 | ||
| with: | ||
| distribution: goreleaser | ||
| version: v1.24.0 |
There was a problem hiding this comment.
[P1] Remove --clean when packaging prebuilt binaries
The workflow compiles and copies the release binaries into dist/… and then runs GoReleaser with args: release --clean --skip=build. The --clean flag deletes the entire dist directory before GoReleaser begins, but --skip=build tells GoReleaser not to rebuild the binaries. On a published release this step will consistently fail because no binaries are left for GoReleaser to archive or turn into packages (stat dist/wireframe_linux_amd64/wireframe: no such file or directory). Drop --clean or stop skipping the build so the packaging step has inputs.
Useful? React with 👍 / 👎.
| - name: Build binaries | ||
| run: | | ||
| cross build --target x86_64-unknown-linux-gnu --release | ||
| cross build --target x86_64-apple-darwin --release |
There was a problem hiding this comment.
[P1] Cross build step targets unsupported macOS toolchain
The job attempts to run cross build --target x86_64-apple-darwin. The cross project intentionally does not ship Docker images for Apple targets because the macOS SDK cannot be redistributed, so this command fails on ubuntu-latest runners before packaging ever runs. The release workflow will never complete successfully until the macOS build is removed or performed on a macOS runner with an appropriate toolchain.
Useful? React with 👍 / 👎.
1 participant
Summary
Testing
make fmtmake lintmake testhttps://chatgpt.com/codex/tasks/task_e_68b4f9dee17483228592056078f9196b
Summary by Sourcery
Automate the release process by building wireframe for Linux, macOS, and FreeBSD and packaging the binaries into archives and system packages via GoReleaser.
New Features:
Build:
CI: