chore: replace mitchellh/gox with goreleaser by TerryHowe · Pull Request #31343 · helm/helm

TerryHowe · 2025-09-29T16:04:02Z

What this PR does / why we need it:

Replace archived mitchellh/gox with goreleaser

Closes: #30913
Closes: #30896
Closes: #12707

Special notes for your reviewer:

If applicable:

this PR contains user facing changes (the docs needed label should be applied if so)
this PR contains unit tests
this PR has been tested for backwards compatibility

robertsirc

LGTM

mattfarina

Thanks for working on this. I tried to use it and ran into some issues. Can you please clean these up?

TerryHowe · 2025-10-29T22:10:22Z

This is ready for another look.

benoittgt · 2025-10-30T19:50:51Z

This is a great improvement. I’m wondering if the next step is to use GoReleaser to also publish artifacts on GitHub, so we have a backup when Azure experiences downtime, as it did twice this month.

store the helm artifacts in the github releases #31436

gjenkins8

Nice work!

There is a minor difference in the produced archives, ie.:

# goreleaser
 helm $ tar -tvf _dist/helm-4.0.0-next-windows-amd64.tar.gz                                                                                                                                       
-rw-r--r--  0 gjenkins8 staff   11373 Nov  5  2022 LICENSE
-rw-r--r--  0 gjenkins8 staff    4540 Oct  1 14:13 README.md
-rwxr-xr-x  0 gjenkins8 staff 67098112 Oct 31 07:11 windows-amd64/helm.exe

# gox
helm $ tar -tvf _dist/helm-4.0.0-next-windows-amd64.tar.gz
drwxr-xr-x  0 gjenkins8 staff       0 Oct 31 07:30 windows-amd64/
-rw-r--r--  0 gjenkins8 staff   11373 Oct 31 07:30 windows-amd64/LICENSE
-rw-r--r--  0 gjenkins8 staff    4540 Oct 31 07:30 windows-amd64/README.md
-rwxr-xr-x  0 gjenkins8 staff 67101184 Oct 31 07:30 windows-amd64/helm.exe

the LICENSE and README.md files are no longer in the same directory as the binary. But I think this is fine (and probably expected today)

LGTM

scottrigby

goreleaser is a good move.

My main question is, should we configure gorelaser to keep the same file pattern we have now for checksums (including .asc sig info per checksum file), as opposed to a single file containing all checksums?

Also, we should make any needed changes in scripts/get-helm-4 in this same PR.

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

Copilot

Pull request overview

This PR replaces the archived mitchellh/gox-based cross-build/release flow with GoReleaser, wiring make build-cross/make dist to GoReleaser and adding a .goreleaser.yaml configuration.

Changes:

Swap Makefile cross-build and dist packaging from gox to goreleaser.
Add .goreleaser.yaml to define the build matrix and archive generation.
Update the canary release GitHub Actions job to call make dist without a separate make build-cross.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
Makefile	Replaces `gox` install and usage with `goreleaser` for cross-build and dist.
.goreleaser.yaml	Introduces GoReleaser configuration for builds/archives/checksums.
.github/workflows/release.yml	Adjusts canary job build step to rely on `make dist` instead of `make build-cross`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

TerryHowe · 2026-05-02T17:26:07Z

@scottrigby Good catches — addressed in the latest commits:

checksums.txt: Disabled goreleaser's built-in aggregate checksum file (checksum: disable: true). Per-archive .sha256 and .sha256sum files are still generated by make checksum as before, and make sign still produces per-archive .asc signatures.
zip for all platforms: Goreleaser was creating .zip archives for Linux/darwin too. Fixed with format_overrides so zip is Windows-only, matching the existing behavior.
scripts/get-helm-4: The script does not need changes. It downloads helm-$TAG-$OS-$ARCH.tar.gz.sha256 (still produced by make checksum) and verifies .asc signatures from GitHub Releases (still produced by make sign). The binary path inside archives (OS-ARCH/helm) is unchanged.

TerryHowe · 2026-05-02T17:26:07Z

@scottrigby Good catches — addressed in the latest commits:

checksums.txt: Disabled goreleaser's built-in aggregate checksum file (checksum: disable: true). Per-archive .sha256 and .sha256sum files are still generated by make checksum as before, and make sign still produces per-archive .asc signatures.
zip for all platforms: Goreleaser was creating .zip archives for Linux/darwin too. Fixed with format_overrides so zip is Windows-only, matching the existing behavior.
scripts/get-helm-4: The script does not need changes. It downloads helm-$TAG-$OS-$ARCH.tar.gz.sha256 (still produced by make checksum) and verifies .asc signatures from GitHub Releases (still produced by make sign). The binary path inside archives (OS-ARCH/helm) is unchanged.

…rchive names Signed-off-by: Terry Howe <terrylhowe@gmail.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

TerryHowe · 2026-05-02T17:58:49Z

Branch (goreleaser) vs Main (gox) — VERSION=v4.1.0

Archive naming — both correct ✅

Both produce helm-v4.1.0-linux-amd64.tar.gz with the v prefix. The GORELEASER_CURRENT_TAG=$(VERSION) fix works.

Zip files — now aligned ✅

┌───────┬─────────────────────────────────────────────┬───────────────────────────────────────────────────────┐           
│       │                   Branch                    │                         Main                          │
├───────┼─────────────────────────────────────────────┼───────────────────────────────────────────────────────┤
│ *.zip │ Windows only (windows-amd64, windows-arm64) │ All platforms (darwin, linux, windows) — old behavior │
└───────┴─────────────────────────────────────────────┴───────────────────────────────────────────────────────┘

The branch correctly restricts zip to Windows. Main's make dist calls zip on every platform directory indiscriminately.

Checksum files — branch has them, main's build had issues

Branch creates per-archive .sha256 and .sha256sum:
helm-v4.1.0-linux-amd64.tar.gz.sha256 → ad1958ae2ed5986e7153c...
helm-v4.1.0-linux-amd64.tar.gz.sha256sum → ad1958ae2ed5986... helm-v4.1.0-linux-amd64.tar.gz
Main showed no .sha256 files and left a ziKZS21Z temp file — the zip step interrupted mid-build (likely zip colliding with
the temp file mechanism on macOS). Not a branch issue.

No checksums.txt on branch ✅

The checksum: disable: true fix works — no aggregate file.

Goreleaser puts LICENSE and README.md at the archive root; gox puts them inside the OS-ARCH/ subdirectory. This was noted
by gjenkins8 earlier and accepted as fine.

New platform on branch ✅

Branch adds linux-loong64 (from PR #31338 merged to main). Not a regression — main just predates that merge.

Extra goreleaser metadata files

Branch produces artifacts.json, config.yaml, metadata.json in _dist/. These are goreleaser internals and aren't uploaded
(the release workflow uploads with --pattern helm-* which skips them).

Summary

After all the fixes, the branch output is functionally correct and closely matches main's intent. The only intentional
differences are: zip restricted to Windows only, linux-loong64 added, and LICENSE/README.md at the archive root instead of
the OS-ARCH/ subdir.

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

goreleaser v2 has a bug with no_unique_dist_dir where it registers archive tasks for all sub-arch variants even when constraints limit builds to one per arch, causing archive collision errors. Switch dist target to use goreleaser build (binaries only) and create tar.gz/zip archives manually, copying LICENSE and README.md into each platform directory to match the existing archive structure. Add sub-arch constraints (goamd64, goarm64, go386, goriscv64) to ensure only one variant is built per architecture. Signed-off-by: Terry Howe <terrylhowe@gmail.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

sabre1041

LGTM

With goreleaser now available, there are additional options that we can look to both deprecate some of the make targets as well as add new capabilities

addressed

pull-request-size Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Sep 29, 2025

benoittgt reviewed Sep 29, 2025

View reviewed changes

Comment thread Makefile Outdated

gjenkins8 reviewed Oct 1, 2025

View reviewed changes

Comment thread .goreleaser.yml Outdated

gjenkins8 reviewed Oct 1, 2025

View reviewed changes

Comment thread Makefile

TerryHowe force-pushed the chore-replace-mitchellh-gox-with-goreleaser branch from 63f8cf0 to c01ac8b Compare October 2, 2025 15:36

gjenkins8 reviewed Oct 3, 2025

View reviewed changes

Comment thread Makefile Outdated

gjenkins8 reviewed Oct 3, 2025

View reviewed changes

Comment thread Makefile Outdated

gjenkins8 mentioned this pull request Oct 10, 2025

Add loongarch64 support #31338

Merged

2 tasks

robertsirc previously approved these changes Oct 22, 2025

View reviewed changes

robertsirc added the Has One Approval This PR has one approval. It still needs a second approval to be merged. label Oct 22, 2025

mattfarina previously requested changes Oct 29, 2025

View reviewed changes

Comment thread Makefile Outdated

Comment thread .goreleaser.yaml

Comment thread .goreleaser.yaml

Comment thread Makefile

TerryHowe dismissed robertsirc’s stale review via ae7b2f3 October 29, 2025 19:36

TerryHowe force-pushed the chore-replace-mitchellh-gox-with-goreleaser branch from dadab9e to ae7b2f3 Compare October 29, 2025 19:36

pull-request-size Bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Oct 29, 2025

gjenkins8 previously approved these changes Oct 31, 2025

View reviewed changes

mattfarina reviewed Oct 31, 2025

View reviewed changes

Comment thread Makefile Outdated

TerryHowe dismissed gjenkins8’s stale review via 52377b7 November 24, 2025 12:21

TerryHowe force-pushed the chore-replace-mitchellh-gox-with-goreleaser branch from 51597d6 to 52377b7 Compare November 24, 2025 12:21

gjenkins8 previously approved these changes Nov 30, 2025

View reviewed changes

TerryHowe mentioned this pull request Jan 15, 2026

store the helm artifacts in the github releases #31436

Open

gjenkins8 requested review from mattfarina and robertsirc January 22, 2026 00:54

joejulian previously approved these changes Feb 6, 2026

View reviewed changes

benoittgt mentioned this pull request Feb 11, 2026

please update https://get.helm.sh/helm4-latest-version #31825

Closed

scottrigby reviewed Feb 12, 2026

View reviewed changes

gjenkins8 reviewed Feb 13, 2026

View reviewed changes

Comment thread .goreleaser.yaml Outdated

chore: replace mitchellh/gox with goreleaser

075c096

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

TerryHowe force-pushed the chore-replace-mitchellh-gox-with-goreleaser branch from 52377b7 to eaa0910 Compare May 2, 2026 16:30

Copilot started reviewing on behalf of TerryHowe May 2, 2026 16:30 View session

fix: use index for optional env var in version_template

e49a1dc

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

TerryHowe dismissed stale reviews from joejulian and gjenkins8 via e49a1dc May 2, 2026 16:34

Copilot AI reviewed May 2, 2026

View reviewed changes

Comment thread .goreleaser.yaml Outdated

Comment thread Makefile Outdated

Comment thread Makefile Outdated

Comment thread Makefile

Comment thread Makefile

Comment thread .goreleaser.yaml Outdated

fix: disable goreleaser checksums.txt and restrict zip to windows only

93103ce

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve v-prefix in a…

04885dd

…rchive names Signed-off-by: Terry Howe <terrylhowe@gmail.com>

Copilot AI review requested due to automatic review settings May 2, 2026 17:35

Copilot started reviewing on behalf of TerryHowe May 2, 2026 17:36 View session

Copilot AI reviewed May 2, 2026

View reviewed changes

Comment thread .github/workflows/release.yml

Comment thread Makefile

Comment thread Makefile

Comment thread Makefile Outdated

Comment thread .goreleaser.yaml Outdated

fix: address goreleaser build issues flagged in review

c075022

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

ci: add fetch-depth 0 to canary checkout for goreleaser

8289940

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

Copilot AI review requested due to automatic review settings May 2, 2026 18:12

Copilot started reviewing on behalf of TerryHowe May 2, 2026 18:13 View session

Copilot AI reviewed May 2, 2026

View reviewed changes

Comment thread Makefile

Comment thread Makefile

Comment thread Makefile Outdated

TerryHowe added 2 commits May 2, 2026 12:25

chore: remove build-cross dependency from test-acceptance

d199a1a

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

Copilot AI review requested due to automatic review settings May 3, 2026 01:19

Copilot started reviewing on behalf of TerryHowe May 3, 2026 01:19 View session

Copilot AI reviewed May 3, 2026

View reviewed changes

Comment thread Makefile

Comment thread Makefile

Comment thread Makefile

Comment thread .github/workflows/release.yml

fix: add -extldflags -static to dist target to match build-cross

f60ab7c

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

sabre1041 approved these changes May 3, 2026

View reviewed changes

gjenkins8 approved these changes May 3, 2026

View reviewed changes

gjenkins8 merged commit ad18580 into helm:main May 3, 2026
5 checks passed

scottrigby mentioned this pull request May 4, 2026

build: Clean up Goreleaser change #32098

Merged

3 tasks

Conversation

TerryHowe commented Sep 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

robertsirc left a comment

Choose a reason for hiding this comment

Uh oh!

mattfarina left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TerryHowe commented Oct 29, 2025

Uh oh!

benoittgt commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gjenkins8 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

scottrigby left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TerryHowe commented May 2, 2026

Uh oh!

TerryHowe commented May 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TerryHowe commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sabre1041 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

TerryHowe commented Sep 29, 2025 •

edited

Loading

benoittgt commented Oct 30, 2025 •

edited

Loading

gjenkins8 left a comment •

edited

Loading

TerryHowe commented May 2, 2026 •

edited

Loading