chore(release): pin GoReleaser and migrate off deprecated config - #1045
Open
alexluong wants to merge 3 commits into
Open
chore(release): pin GoReleaser and migrate off deprecated config#1045alexluong wants to merge 3 commits into
alexluong wants to merge 3 commits into
Conversation
The release workflow ran `goreleaser-action@v4` with `version: latest`, so every tag push built with whatever GoReleaser shipped that morning — v1.2.0 happened to use 2.17.1, unchosen. `goreleaser check` also failed on three deprecations, meaning a future release could break with no warning and nowhere to catch it but a tag push. - Pin to v2.17.1 (the version v1.2.0 actually released with) and bump the action to v6. - archives: `format` -> `formats`. Drops the windows->zip `format_overrides`, which was dead — builds are `goos: [linux]` only, so it could never fire. - dockers + docker_manifests -> dockers_v2. One buildx build now covers both platforms and pushes the manifest in a single step, so the Dockerfile copies binaries from `$TARGETPLATFORM/`. `sbom: false` keeps the published manifest to the same two platform entries as today; SBOM attestations would show up as extra "unknown/unknown" platforms on Docker Hub. - Drop DOCKER_CLI_EXPERIMENTAL, only needed by the old docker_manifests path. `goreleaser check` is clean and `goreleaser release --snapshot` builds both images: correct architectures, version ldflags stamped, all binaries and the entrypoint present. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`sbom: false` alone was not enough. Verified by pushing the same context to a scratch repo: the manifest came back with linux/amd64, linux/arm64, and two `unknown/unknown` entries. GoReleaser never passes `--provenance`, so buildx applies its default of attaching provenance whenever it pushes, independent of the `sbom` setting. With `--provenance=false` the pushed manifest is exactly the two platform entries, matching what dockers/docker_manifests publishes today. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
alexbouchardd
approved these changes
Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
The release workflow downloaded a different GoReleaser on every tag push, and our config used three things GoReleaser has deprecated. Neither has broken a release yet, but both would break one without warning — and the only place that failure can surface is a tag push, after the tag exists.
This pins the version and clears all three deprecations. Nothing about the published release changes: same archives, same image name, same two-platform manifest.
What was wrong
release.ymlrangoreleaser-action@v4withversion: latest. v1.2.0 built with GoReleaser 2.17.1 — not because we chose it, but because that's what was newest that morning. Meanwhilegoreleaser checkexited non-zero on three deprecated properties. Put together: the day GoReleaser removes one of them, a release fails mid-flight.Changes
Pin the version.
version: "v2.17.1"— the version v1.2.0 actually released with, so this is a no-op for the next release. Action bumpedv4→v6.archives.format→formats. Also deletes the windows→zipformat_overrides, which was dead code:buildsaregoos: [linux]only, so a windows override could never fire.dockers+docker_manifests→dockers_v2. The bigger one. GoReleaser now does a singlebuildxbuild across both platforms and pushes the manifest in one step, instead of building per-arch images and stitching a manifest afterward. Two consequences:$TARGETPLATFORM/, soDockerfile.goreleasercopies from$TARGETPLATFORM/outpostrather thanoutpost.dockers_v2attaches SBOM and provenance attestations by default. This PR turns both off (sbom: falseplus--provenance=false, since GoReleaser never passes--provenanceand buildx attaches it whenever it pushes) so the published manifest stays exactly the two platform entries it has today. That keeps this PR to "the release still works," with no change to the artifact. chore(release): publish signed images with SBOM and provenance #1046 turns them on deliberately.DOCKER_CLI_EXPERIMENTALdropped, only the olddocker_manifestspath needed it. The existing QEMU and Buildx setup steps are still required.Verification
goreleaser checkis clean (exit 0, no deprecations) on 2.17.1.goreleaser release --snapshot --cleancompletes and produces:outpost_Linux_x86_64.tar.gz,outpost_Linux_arm64.tar.gzarch=amd64/arch=arm64confirmed viadocker image inspectoutpost --versionruns in each and reports the right version, so the ldflags still applyoutpost,outpost-server,entrypoint.sh,/bin/shall present, entrypoint unchangedNot verified locally: the manifest push.
dockers_v2can't produce a multi-arch manifest without pushing, so snapshot mode builds platform-suffixed images instead. Worth a throwaway sha tag to a personal namespace before this merges, to confirm the pushed manifest lists exactlylinux/amd64andlinux/arm64— matching whathookdeck/outpost:v1.2.0looks like today.