.goreleaser.yaml

version: 2
project_name: reach

before:
  hooks:
    - go mod tidy
    - go test ./...
    # The helper binary, built for every platform a target might run, and
    # shipped inside every archive. reach looks for these beside its own binary,
    # so an operator on macOS can use the helper tier against a Linux target
    # without a Go toolchain — and reach never has to download an executable at
    # run time to put on someone else's machine.
    #
    # Built into .helpers/ rather than dist/. before-hooks run *before*
    # goreleaser prepares its distribution directory, and that step refuses a
    # dist/ that is not empty — so building here failed the release outright,
    # and the failure was in the one step nobody runs locally.
    - mkdir -p .helpers
    - >-
      env GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -trimpath
      -ldflags "-s -w -X main.version={{.Version}}"
      -o .helpers/reach-helper-linux-amd64 ./cmd/reach-helper
    - >-
      env GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -trimpath
      -ldflags "-s -w -X main.version={{.Version}}"
      -o .helpers/reach-helper-linux-arm64 ./cmd/reach-helper
    - >-
      env GOOS=darwin GOARCH=amd64 CGO_ENABLED=0 go build -trimpath
      -ldflags "-s -w -X main.version={{.Version}}"
      -o .helpers/reach-helper-darwin-amd64 ./cmd/reach-helper
    - >-
      env GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 go build -trimpath
      -ldflags "-s -w -X main.version={{.Version}}"
      -o .helpers/reach-helper-darwin-arm64 ./cmd/reach-helper

builds:
  - id: reach
    main: ./cmd/reach
    binary: reach
    env: [CGO_ENABLED=0]
    # reach runs on the operator's machine, not the target, so these are the
    # platforms a developer drives agents from. The *target* platforms are a
    # different and wider set — see the helper builds above, which ship inside
    # every archive including the Windows ones, because a Windows operator's
    # target is a POSIX host.
    goos: [linux, darwin, windows]
    goarch: [amd64, arm64]
    ldflags:
      - -s -w
        -X main.buildVersion={{.Version}}
        -X main.buildCommit={{.ShortCommit}}
        -X main.buildDate={{.CommitDate}}
    mod_timestamp: '{{ .CommitTimestamp }}'

archives:
  - formats: [tar.gz]
    # Windows gets a zip: tar.gz needs a tool that is not on a stock Windows,
    # and an archive an operator cannot open is not a release.
    format_overrides:
      - goos: windows
        formats: [zip]
    name_template: >-
      {{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}
    files:
      - README.md
      - LICENSE
      - CHANGELOG.md
      - docs/**
      - src: .helpers/*
        dst: .
        info: { mode: 0755 }

# The container image is published to GitHub Packages (ghcr.io). It is the same
# binary as the archives, with an ssh client and the helper builds beside it —
# see Dockerfile for why those two things have to be in the image.
#
# One image per architecture, then a manifest that joins them, because a
# manifest list is what makes `docker pull` do the right thing on an arm64
# machine. `skip_push: auto` keeps snapshots and pre-releases local: CI builds
# these on every push to prove the Dockerfile still works, and that run must not
# publish anything.
dockers:
  - id: reach-linux-amd64
    ids: [reach]
    goos: linux
    goarch: amd64
    dockerfile: Dockerfile
    use: buildx
    skip_push: auto
    image_templates:
      - 'ghcr.io/bojieli/agentreach:{{ .Version }}-amd64'
      - 'ghcr.io/bojieli/agentreach:latest-amd64'
    extra_files: ['.helpers']
    build_flag_templates:
      - '--platform=linux/amd64'
      - '--label=org.opencontainers.image.title={{ .ProjectName }}'
      - '--label=org.opencontainers.image.description=Teleoperation for coding agents: the agent runs locally, its tool calls act on a remote target.'
      - '--label=org.opencontainers.image.url=https://github.com/bojieli/agentreach'
      - '--label=org.opencontainers.image.source=https://github.com/bojieli/agentreach'
      - '--label=org.opencontainers.image.version={{ .Version }}'
      - '--label=org.opencontainers.image.revision={{ .FullCommit }}'
      - '--label=org.opencontainers.image.created={{ .Date }}'
      - '--label=org.opencontainers.image.licenses=MIT'

  - id: reach-linux-arm64
    ids: [reach]
    goos: linux
    goarch: arm64
    dockerfile: Dockerfile
    use: buildx
    skip_push: auto
    image_templates:
      - 'ghcr.io/bojieli/agentreach:{{ .Version }}-arm64'
      - 'ghcr.io/bojieli/agentreach:latest-arm64'
    extra_files: ['.helpers']
    build_flag_templates:
      - '--platform=linux/arm64'
      - '--label=org.opencontainers.image.title={{ .ProjectName }}'
      - '--label=org.opencontainers.image.description=Teleoperation for coding agents: the agent runs locally, its tool calls act on a remote target.'
      - '--label=org.opencontainers.image.url=https://github.com/bojieli/agentreach'
      - '--label=org.opencontainers.image.source=https://github.com/bojieli/agentreach'
      - '--label=org.opencontainers.image.version={{ .Version }}'
      - '--label=org.opencontainers.image.revision={{ .FullCommit }}'
      - '--label=org.opencontainers.image.created={{ .Date }}'
      - '--label=org.opencontainers.image.licenses=MIT'

docker_manifests:
  - name_template: 'ghcr.io/bojieli/agentreach:{{ .Version }}'
    skip_push: auto
    image_templates:
      - 'ghcr.io/bojieli/agentreach:{{ .Version }}-amd64'
      - 'ghcr.io/bojieli/agentreach:{{ .Version }}-arm64'
  # `latest` only ever moves on a real, non-prerelease tag.
  - name_template: 'ghcr.io/bojieli/agentreach:latest'
    skip_push: auto
    image_templates:
      - 'ghcr.io/bojieli/agentreach:latest-amd64'
      - 'ghcr.io/bojieli/agentreach:latest-arm64'

checksum:
  name_template: checksums.txt

# reach's helper tier writes a binary onto a machine the operator may not own,
# and the release archive is where that binary comes from. Provenance is not
# decoration here: someone deciding whether to let reach install something on
# their production host should be able to establish that the artifact came from
# this repository's tagged CI run and nowhere else.
sboms:
  - artifacts: archive

# The checksums file is signed rather than each artifact. checksums.txt already
# covers every archive, so one signature over it is a signature over all of
# them, and verification stays short enough that someone will actually run it.
signs:
  - cmd: cosign
    certificate: '${artifact}.pem'
    args:
      - sign-blob
      - '--output-certificate=${certificate}'
      - '--output-signature=${signature}'
      - '${artifact}'
      - '--yes'
    artifacts: checksum
    output: true

snapshot:
  version_template: "{{ incpatch .Version }}-next"

changelog:
  sort: asc
  filters:
    exclude: ['^docs:', '^test:', '^chore:', Merge pull request]

release:
  # The generated list below is every commit in the range, which for a first
  # release is 77 of them. CHANGELOG.md is the version written for someone
  # deciding whether to upgrade, so point at it before the wall of subjects.
  header: |
    [CHANGELOG.md](https://github.com/bojieli/agentreach/blob/{{ .Tag }}/CHANGELOG.md)
    is the readable account of what changed and why. The commit list below is
    the complete one.

  footer: |
    ## Verifying this release

    Every archive ships `reach` plus the helper binary for each target platform.
    At the helper tier reach copies that binary onto your target, so it is worth
    knowing where it came from.

    Check the contents against `checksums.txt`:

    ```console
    sha256sum -c checksums.txt --ignore-missing
    ```

    And check that `checksums.txt` itself came from this repository's tagged CI
    run. The release is signed with [cosign](https://docs.sigstore.dev/) keyless
    signing, so there is no public key to fetch — the identity is the workflow
    that built it:

    ```console
    cosign verify-blob checksums.txt \
      --certificate checksums.txt.pem \
      --signature checksums.txt.sig \
      --certificate-identity-regexp '^https://github.com/bojieli/agentreach/\.github/workflows/release\.yml@refs/tags/' \
      --certificate-oidc-issuer https://token.actions.githubusercontent.com
    ```

    Each archive also ships with an SBOM (`.sbom.json`, SPDX) listing everything
    compiled into it.

    ## Container image

    The same build is on GitHub Packages for amd64 and arm64:

    ```console
    docker run --rm -v "$HOME/.ssh:/root/.ssh:ro" \
      ghcr.io/bojieli/agentreach:{{ .Version }} version
    ```

    Nothing was published here until CI was green on this tag — every test on
    every platform, the linters, the fuzz runs, govulncheck, the cross-compiles
    and a full release dry run.