feat: goreleaser release #101

developer-guy · 2021-12-04T21:43:50Z

Signed-off-by: Batuhan Apaydın batuhan.apaydin@trendyol.com
Co-authored-by: Furkan Türkal furkan.turkal@trendyol.com

Fixes #100

https://github.com/developer-guy/addlicense/releases/tag/v0.999.0

willnorris

I've left a bunch of comments below. I worry about one of the last ones actually being a deal breaker, which is an easy way to test the image publication. We get that for free with our actions based workflow today, which you can see in my own fork here: https://github.com/willnorris/addlicense/pkgs/container/addlicense

Looking at the configuration required, I'm also surprised by the amount of additional config we have to do manually that was handled for us with the actions approach before (setting image tags, labels, etc). If signing images with cosign is the end goal, does that actually rely on goreleaser in any way? (Though I'm now also a little concerned that the OIDC support in cosign is still very experimental, so is it really ready for adoption yet?)

I know y'all put some real work into this which I appreciate, and I'm happy to continue talking through things, but I'm now a little more concerned about whether this is actually a good move.

willnorris · 2021-12-06T19:39:16Z

.goreleaser.yaml

    goos:
      - linux
      - windows
      - darwin
    goarch:
      - amd64
      - arm64
+#signs:


I think it'd be good to keep this PR focused on just switching how the docker image is published, without introducing any of the signing functionality. You have that, since this is commented out, but I think it'd be clearer to just leave it out of this PR entirely.

yep, thanks fixed.

willnorris · 2021-12-06T19:45:28Z

.github/workflows/release.yaml

@@ -5,65 +5,47 @@ on:
    tags:
      - '*'

+permissions:
+  contents: write
+  id-token: write


I don't think this id-token permission is needed yet, is it? I believe that will be for signing (which we're not doing yet)?

yep, thanks fixed.

willnorris · 2021-12-06T19:54:58Z

.github/workflows/release.yaml

-      -
-        name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@5a54d7e660bda43b405e8463261b3d25631ffe86 #v2.7.0
+      - uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # pin@v1


our convention is to include the full version we are pinning to. So # v1.10.0 in this case. Same with version comments below.

thanks fixed.

willnorris · 2021-12-06T19:55:21Z

.github/workflows/release.yaml

-        uses: goreleaser/goreleaser-action@5a54d7e660bda43b405e8463261b3d25631ffe86 #v2.7.0
+      - uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # pin@v1
+      - uses: docker/setup-buildx-action@94ab11c41e45d028884a99163086648e898eed25 # pin@v1
+      - uses: sigstore/cosign-installer@e5c096a9feb091d8afe0168547370270986f2f71 # pin@v1.3.1


no need for this, since we're not signing right now.

thanks fixed.

willnorris · 2021-12-06T19:55:48Z

.github/workflows/release.yaml

+      - uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # pin@v1
+      - uses: docker/setup-buildx-action@94ab11c41e45d028884a99163086648e898eed25 # pin@v1
+      - uses: sigstore/cosign-installer@e5c096a9feb091d8afe0168547370270986f2f71 # pin@v1.3.1
+      - name: dockerhub-login


we don't publish to dockerhub, so don't need this

thanks fixed.

willnorris · 2021-12-06T19:56:43Z

.goreleaser.yaml

+#      - '${artifact}'
+dockers:
+  - image_templates:
+      - 'google/addlicense:{{ .Tag }}-amd64'


we don't publish to dockerhub, so can remove this name throughout

thanks, fixed

willnorris · 2021-12-06T19:58:38Z

Dockerfile.goreleaser

+# make a bare minimal image
+FROM scratch
+
+WORKDIR app


we want to keep the behavior the same as the existing Dockerfile, so this should be:

# source to be scanned should be mounted to /src WORKDIR /src

thanks, fixed

willnorris · 2021-12-06T19:59:09Z

Dockerfile.goreleaser

+
+WORKDIR app
+
+COPY addlicense ./


COPY addlicense /app/addlicense

thanks, fixed

willnorris · 2021-12-06T20:03:46Z

.goreleaser.yaml

+dockers:
+  - image_templates:
+      - 'google/addlicense:{{ .Tag }}-amd64'
+      - 'ghcr.io/google/addlicense:{{ .Tag }}-amd64'


this is really unfortunate that this is hardcoded. That makes it a lot harder to test this in forks, unless I'm missing something. For example, your https://github.com/developer-guy/addlicense/releases/tag/v0.999.0 tag demonstrates creating the release artifacts, but doesn't demonstrate publishing the docker image. That something we were able to do with the actions based approach.

It doesn't look like goreleaser's name templates supports the GitHub repo owner, and custom variables are a "pro" feature.

We need some way to test image publication to GHCR before making changes live.

btw, we can use those variables as an environment variable to pass the registry and the image name to the GoReleaser by using the same syntax, can't we?

${{ env.REGISTRY }}/${{ env.IMAGE_NAME }

hello @willnorris, I've updated the please see. We need environment variables named like this REGISTRY and IMAGE_NAME.

https://github.com/google/addlicense/pull/101/files#diff-e426ed45842837026e10e66af23d9c7077e89eacbe6958ce7cb991130ad05adaR48-R49

https://github.com/google/addlicense/pull/101/files#diff-7326b55c062b0f46fe9e39aace0a25f4515cf206040fb91a6fd2cae839f5e826R20

willnorris · 2021-12-08T23:52:03Z

Given GitHub's blog post yesterday, I tried using the purely Actions based cosign workflow on a personal project of mine, and it worked really well. I wonder if we just do that here as well? Any major downside that I'm not seeing?

developer-guy · 2021-12-09T07:57:22Z

Given GitHub's blog post yesterday, I tried using the purely Actions based cosign workflow on a personal project of mine, and it worked really well. I wonder if we just do that here as well? Any major downside that I'm not seeing?

No, there is no major downside at all. You're right. We can do it that way as well. Still, GoReleaser already supports that, but it should wait for cosign v1.4.x for the keyless feature, that's why I commented out the signs and docker_signs sections within the .goreleaser.yml file, but anyway, we can do it without using GoReleaser also if you want to move forward like this.

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Co-authored-by: Furkan Türkal <furkan.turkal@trendyol.com> Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

developer-guy · 2021-12-10T18:44:35Z

kindly ping @willnorris, cosign v1.4.1 with some bunch of fixes is released today, so, everything seems fine in cosign project which means that we can start using it to sign addlicense both binary and container image 🤩 similar works being done in several projects such as google/ko, goreleaser.

willnorris

Okay, so there's a bunch of comments below. I also tried doing suggested edits to show the exact changes I had in mind.

By the end of all of this, I did get this working in my personal fork of the project (images published here: https://github.com/willnorris/addlicense/pkgs/container/addlicense).

But after all of that (and before you actually start implementing these changes), I'm honestly still not completely convinced that moving the docker build into goreleaser is really worth all this effort. I've certainly learned a lot through this process, getting these builds to work, playing with a lot of new features in both goreleaser and docker I've never used, and learning about cosign. So that's been fun. And it means I'm now coming from a much more informed position than when I started when I ask, what does using goreleaser to build the image actually gain us at this point? I'm not seeing it.

(That said, I'm certainly convinced on using cosign to sign binaries and docker images, which I think is what you were ultimately after?)

willnorris · 2021-12-10T19:29:53Z

.github/workflows/release.yaml

+    env:
+      DOCKER_CLI_EXPERIMENTAL: "enabled"
+      REGISTYRY: "ghcr.io"
+      IMAGE_NAME: "google/addlicense"


this still has the same "testing in forks issues" if we hardcode the value.

Suggested change

IMAGE_NAME: "google/addlicense"

IMAGE_NAME: ${{ github.repository }}

willnorris · 2021-12-10T19:32:16Z

.github/workflows/release.yaml

-      -
-        name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@5a54d7e660bda43b405e8463261b3d25631ffe86 #v2.7.0
+      - uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # pin@v1.2.0


we had an existing convention for all of these comments that would be nice to not change... #v2.6.1. Though i guess a space helps with legibility.

The real reason I care is that I'm trying to get dependabot to add support for updating these comments, and I'd like to keep them in a consistent format.

Suggested change

- uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # pin@v1.2.0

- uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1.2.0

willnorris · 2021-12-10T19:40:17Z

.github/workflows/release.yaml

+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: ghcr-login
+        if: startsWith(github.ref, 'refs/tags/v')


maybe change the trigger for this workflow to only match "v*" tags, so then we don't need this check here?

Suggested change

if: startsWith(github.ref, 'refs/tags/v')

willnorris · 2021-12-10T19:41:47Z

.github/workflows/release.yaml

+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 # pin@v1.10.0
+        with:
+          registry: ghcr.io


Suggested change

registry: ghcr.io

registry: ${{ env.REGISTRY }}

willnorris · 2021-12-10T19:42:31Z

.github/workflows/release.yaml

@@ -5,65 +5,48 @@ on:
    tags:
      - '*'


Suggested change

- '*'

- 'v*'

willnorris · 2021-12-10T19:54:09Z

.github/workflows/release.yaml

+      - name: dockerhub-login
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 # pin@v1.10.0
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}


dockerhub login is still here, but should be removed.

Suggested change

- name: dockerhub-login

if: startsWith(github.ref, 'refs/tags/v')

uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 # pin@v1.10.0

with:

username: ${{ secrets.DOCKER_USERNAME }}

password: ${{ secrets.DOCKER_PASSWORD }}

willnorris · 2021-12-10T21:30:08Z

.github/workflows/release.yaml

@@ -5,65 +5,48 @@ on:
    tags:
      - '*'

+permissions:
+  contents: write


need to re-add packages permission to publish images

Suggested change

contents: write

contents: write

packages: write

willnorris · 2021-12-10T21:33:22Z

.goreleaser.yaml

+      - "--platform=linux/arm64"
+    goarch: arm64
+docker_manifests:
+  - name_template: '{{ .Env.REGISTRY }}/{{ .Env.IMAGE_NAME }}::{{ .Tag }}'


typo, fails to build image

Suggested change

- name_template: '{{ .Env.REGISTRY }}/{{ .Env.IMAGE_NAME }}::{{ .Tag }}'

- name_template: '{{ .Env.REGISTRY }}/{{ .Env.IMAGE_NAME }}:{{ .Tag }}'

willnorris · 2021-12-10T21:35:16Z

.goreleaser.yaml

+    image_templates:
+      - '{{ .Env.REGISTRY }}/{{ .Env.IMAGE_NAME }}:{{ .Tag }}-amd64'
+      - '{{ .Env.REGISTRY }}/{{ .Env.IMAGE_NAME }}:{{ .Tag }}-arm64'
+  - name_template: 'ghcr.io/google/addlicense:latest'


missed one hardcoded image name

Suggested change

- name_template: 'ghcr.io/google/addlicense:latest'

- name_template: '{{ .Env.REGISTRY }}/{{ .Env.IMAGE_NAME }}:latest'

willnorris · 2021-12-10T21:38:18Z

.goreleaser.yaml

    goos:
      - linux
      - windows
      - darwin
    goarch:
      - amd64
      - arm64
+dockers:
+  - image_templates:
+      - '{{ .Env.REGISTRY }}/{{ .Env.IMAGE_NAME }}:{{ .Tag }}-amd64'


I don't love having these extra *-{platform} images getting tagged 😕 (as seen here: https://github.com/willnorris/addlicense/pkgs/container/addlicense)

I tried doing multi-architecture builds using the the regular docker actions to build the image, and it's definitely possible to do multi-architecture images without the intermediate tags (the qemu tag here: https://github.com/willnorris/imageproxy-test/pkgs/container/imageproxy-test). I'm not sure if that can easily be done in goreleaser?

willnorris · 2021-12-10T21:50:38Z

ugh, I really hate how GitHub shows comments sometimes. I actually missed your reply here. sigh

So yeah, I think we should add signing support without goreleaser (at least for the docker images). But seriously, thanks for your patience with me on this PR. It's honestly been a lot of fun to learn about these things.

developer-guy · 2021-12-23T07:51:37Z

Hello @willnorris, GoReleaser v1.2.2 has just been released yesterday, and now, GoReleaser is capable of signing releases with a keyless approach using GitHub Actions OIDC flow, and also, another notable feature has been added with v1.2.2 is SBOM support, again, now, GoReleaser can generate an SBOMs for container images by using Syft tool under the hood, please see it all in action on a sample repository:

👉 https://github.com/goreleaser/supply-chain-example

developer-guy force-pushed the master branch from c9c9a64 to 2149704 Compare December 4, 2021 21:44

willnorris requested changes Dec 6, 2021

View reviewed changes

developer-guy force-pushed the master branch from 2149704 to aca580a Compare December 9, 2021 07:59

developer-guy requested a review from willnorris December 9, 2021 08:00

developer-guy force-pushed the master branch from aca580a to 6035e5b Compare December 9, 2021 11:43

feat: goreleaser release

6b2b416

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com> Co-authored-by: Furkan Türkal <furkan.turkal@trendyol.com> Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

developer-guy force-pushed the master branch from 6035e5b to 6b2b416 Compare December 9, 2021 17:48

willnorris requested changes Dec 10, 2021

View reviewed changes

	IMAGE_NAME: "google/addlicense"
	IMAGE_NAME: ${{ github.repository }}

	- uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # pin@v1.2.0
	- uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1.2.0

	- name_template: '{{ .Env.REGISTRY }}/{{ .Env.IMAGE_NAME }}::{{ .Tag }}'
	- name_template: '{{ .Env.REGISTRY }}/{{ .Env.IMAGE_NAME }}:{{ .Tag }}'

	- name_template: 'ghcr.io/google/addlicense:latest'
	- name_template: '{{ .Env.REGISTRY }}/{{ .Env.IMAGE_NAME }}:latest'

feat: goreleaser release #101

Are you sure you want to change the base?

feat: goreleaser release #101

Conversation

developer-guy commented Dec 4, 2021 • edited

willnorris left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

willnorris commented Dec 8, 2021

developer-guy commented Dec 9, 2021

developer-guy commented Dec 10, 2021

willnorris left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

willnorris commented Dec 10, 2021

developer-guy commented Dec 23, 2021

developer-guy commented Dec 4, 2021 •

edited