docs: add comprehensive release process evaluation and recommendations#396
Open
cduggn wants to merge 2 commits into
Open
docs: add comprehensive release process evaluation and recommendations#396cduggn wants to merge 2 commits into
cduggn wants to merge 2 commits into
Conversation
Add detailed analysis of current GoReleaser build process identifying: - Critical security issue: releases can trigger from any branch - Missing CI/CD pipeline for PRs - Manual version management issues - Incomplete supply chain security (no SBOM, signing, attestation) - Docker multi-arch gaps - CGO configuration inconsistencies Includes comparison with industry best practices from kubectl, k6, terraform, and hugo. Provides phased migration plan with GoReleaser enhancements vs Dagger alternative analysis. Recommendation: Keep GoReleaser, add release-please automation, SBOM generation, artifact signing, and comprehensive CI pipeline.
This implements Phase 1 from the release process evaluation, addressing critical security issues and adding professional CI/CD practices. **1. Fix Release Workflow Security (CRITICAL)** - Add branch restriction to only allow releases from main branch - Add explicit verification step to check tag is on main - Fix cache clearing waste by using proper GitHub Actions caching - Add packages:write permission for GHCR - Use go-version-file instead of hardcoded version Changes in .github/workflows/release.yml: - Restrict tag triggers to main branch only - Add verification step that fails if tag not on main - Replace cache clearing with proper cache: true - Update to use latest goreleaser version **2. Add Comprehensive CI Pipeline** - Create new CI workflow for pull requests and main branch pushes - Run linting with golangci-lint-action - Run tests on multiple Go versions (1.22, 1.23) - Add race condition detection - Build verification for all target platforms - Security scanning with Trivy - Code coverage reporting to Codecov - CI success job to ensure all checks pass New file: .github/workflows/ci.yml **3. Fix CGO_ENABLED Inconsistency** - Change Makefile from CGO_ENABLED=1 to CGO_ENABLED=0 - Align with .goreleaser.yaml configuration - Better portability (no CGO dependencies found in project) - Use inline env var instead of go env -w for safety Changes in Makefile: - Update 'run' target to use CGO_ENABLED=0 - Update 'build' target to use CGO_ENABLED=0 **4. Add Caching to Workflows** - Update CodeQL workflow to use go-version-file and cache - Use consistent caching strategy across all workflows - Significant performance improvement for CI runs Changes in .github/workflows/codeql.yml: - Replace hardcoded go-version with go-version-file - Add cache: true for module and build cache **5. Document Release Process** - Create comprehensive release documentation - Include step-by-step release instructions - Add troubleshooting guide - Document CI/CD pipeline - Add release checklist - Reference future improvements from evaluation New file: .github/RELEASE.md **Impact:** - ✅ Fixes critical security issue allowing releases from any branch - ✅ Adds professional CI/CD pipeline matching industry standards - ✅ Improves build consistency and reliability - ✅ Reduces CI run time with proper caching - ✅ Provides clear documentation for contributors and maintainers **Next Steps (Phase 2):** - Implement automated versioning with release-please - Add conventional commit validation - Set up branch protection rules - Add Dependabot configuration Closes #related-to-release-improvements
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add detailed analysis of current GoReleaser build process identifying:
Includes comparison with industry best practices from kubectl, k6, terraform,
and hugo. Provides phased migration plan with GoReleaser enhancements vs
Dagger alternative analysis.
Recommendation: Keep GoReleaser, add release-please automation, SBOM
generation, artifact signing, and comprehensive CI pipeline.