Modernize the release pipeline and fix multi-arch image publishing#465
Merged
Conversation
Replace the binary release with GoReleaser now that the SQL backend is pure Go, and attach signed GitHub build-provenance attestations to both the release archives and the container image. - release.yml: run GoReleaser to produce darwin/linux/windows binaries for amd64/arm64 plus deb/rpm/apk packages, then attest every artifact with actions/attest-build-provenance. - build.yml: drop the per-arch runner matrix that pushed both builds to the same tags (so the second run silently overwrote the first and the image was never actually multi-arch). A single buildx invocation now emits one linux/amd64+linux/arm64 manifest, and the image manifest is attested and the attestation pushed to GHCR. - Dockerfile: cross-compile the pure-Go binary from the build platform using the BuildKit platform args, so multi-arch builds need no QEMU. - Makefile: switch docker/build to buildx and add docker/build/multiarch. - README: document multi-arch images and attestation verification. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pin setup-go to the latest stable release instead of the go.mod version so release binaries always ship from the current toolchain. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This was referenced May 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Now that the SQL backend is pure Go, this reworks the release pipeline along the same lines as
goccy/googlesqliteandgoccy/tobari, and fixes the long-standing multi-arch container image problem using the approach fromgoccy/wasmify.release.yml— Replacesvenstaro/upload-release-action(which only shipped two rawlinux/amd64+darwin/amd64binaries) with GoReleaser. It now produces archives fordarwin/linux/windows×amd64/arm64,deb/rpm/apkpackages, andchecksums.txt. Every artifact gets a signed GitHub build-provenance attestation viaactions/attest-build-provenance..goreleaser.yml(new) — GoReleaser config mirroring the tobari/wasmify setup: cgo-free build withmain.version/main.revisioninjected via ldflags.build.yml— Fix multi-arch publishing. The old per-arch runner matrix (ubuntu-latest+ubuntu-24.04-arm) pushed both builds to the same tags, so the second run silently overwrote the first and the published image was never actually multi-arch. A singlebuildxinvocation now emits onelinux/amd64+linux/arm64manifest. The image manifest is attested and the attestation pushed to GHCR (one digest → one attestation covers all tags).Dockerfile— Cross-compile the pure-Go binary from the build platform using the BuildKit platform args ($BUILDPLATFORM/$TARGETOS/$TARGETARCH), so multi-arch builds need no QEMU emulation.Makefile— Switchdocker/buildtobuildxand add adocker/build/multiarchtarget.README.md— Document the multi-arch image and how to verify attestations withgh attestation verify.Verification
linux/amd64,linux/arm64,darwin/arm64,windows/amd64.goreleaser checkpasses with no warnings.Multi-arch Docker builds were not run locally (no
buildxcomponent on the dev machine); CI installs it viadocker/setup-buildx-action.🤖 Generated with Claude Code