1.12: reliability & security pass

.codespellrc

@@ -0,0 +1,3 @@
+[codespell]
+skip = go.sum,go.mod,.git,dist,TASKS.md
+ignore-words-list = unparseable

.github/Dockerfile

@@ -1,16 +1,10 @@
-# build stage
-FROM golang:alpine AS build
-RUN apk update && apk add git
-ADD . /src
-WORKDIR /src
-ENV CGO_ENABLED=0
-RUN go build \
-    -ldflags "-X github.com/jpillora/chisel/share.BuildVersion=$(git describe --abbrev=0 --tags)" \
-    -o /tmp/bin
-# run stage
+# goreleaser builds the binary and provides it in the build context
+FROM alpine:3 AS certs
+RUN apk add --no-cache ca-certificates
+
 FROM scratch
 LABEL maintainer="dev@jpillora.com"
-COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 WORKDIR /app
-COPY --from=build /tmp/bin /app/bin
-ENTRYPOINT ["/app/bin"]
+COPY chisel /app/bin
+ENTRYPOINT ["/app/bin"]

.github/goreleaser.yml

@@ -52,10 +52,90 @@ archives:
       - none*
 release:
   draft: true
+  replace_existing_draft: true
   prerelease: auto
 changelog:
   sort: asc
   filters:
     exclude:
       - "^docs:"
       - "^test:"
+
+dockers:
+  - image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-amd64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-amd64"
+    use: buildx
+    dockerfile: .github/Dockerfile
+    build_flag_templates:
+      - "--platform=linux/amd64"
+    goarch: amd64
+
+  - image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-arm64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-arm64"
+    use: buildx
+    dockerfile: .github/Dockerfile
+    build_flag_templates:
+      - "--platform=linux/arm64"
+    goarch: arm64
+
+  - image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv7"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv7"
+    use: buildx
+    dockerfile: .github/Dockerfile
+    build_flag_templates:
+      - "--platform=linux/arm/v7"
+    goarch: arm
+    goarm: "7"
+
+  - image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv6"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv6"
+    use: buildx
+    dockerfile: .github/Dockerfile
+    build_flag_templates:
+      - "--platform=linux/arm/v6"
+    goarch: arm
+    goarm: "6"
+
+  - image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-386"
+      - "docker.io/jpillora/chisel:{{ .Version }}-386"
+    use: buildx
+    dockerfile: .github/Dockerfile
+    build_flag_templates:
+      - "--platform=linux/386"
+    goarch: "386"
+
+  - image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-ppc64le"
+      - "docker.io/jpillora/chisel:{{ .Version }}-ppc64le"
+    use: buildx
+    dockerfile: .github/Dockerfile
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+    goarch: ppc64le
+
+# version manifests only — floating tags (latest / X / X.Y) are promoted
+# by .github/workflows/promote.yml when the draft GitHub release is
+# published (release stage 2)
+docker_manifests:
+  - name_template: "ghcr.io/jpillora/chisel:{{ .Version }}"
+    image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-amd64"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-arm64"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv7"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv6"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-386"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-ppc64le"
+
+  - name_template: "docker.io/jpillora/chisel:{{ .Version }}"
+    image_templates:
+      - "docker.io/jpillora/chisel:{{ .Version }}-amd64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-arm64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv7"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv6"
+      - "docker.io/jpillora/chisel:{{ .Version }}-386"
+      - "docker.io/jpillora/chisel:{{ .Version }}-ppc64le"

.github/workflows/ci.yml

@@ -1,10 +1,24 @@
 name: CI
 on:
   pull_request: {}
-  push: {}
-permissions: write-all
+  push:
+    branches: [master]
+    tags: ["v*"]
+permissions:
+  contents: read
 jobs:
   # ================
+  # SPELLING CHECK
+  # ================
+  codespell:
+    name: Spelling
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: codespell
+        uses: codespell-project/actions-codespell@v2
+  # ================
   # BUILD AND TEST JOB
   # ================
   test:
@@ -16,7 +30,7 @@ jobs:
     runs-on: ${{ matrix.platform }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Set up Go
@@ -29,64 +43,50 @@ jobs:
       - name: Test
         run: go test -v ./...
   # ================
-  # RELEASE BINARIES (on push "v*" tag)
+  # RELEASE STAGE 1 (on push "v*" tag, after merging to master)
+  # Creates a DRAFT GitHub release and pushes version-tagged binaries,
+  # packages, and multi-arch Docker images via GoReleaser. Floating
+  # Docker tags (latest / X / X.Y) are not touched here — publishing
+  # the draft release triggers promote.yml (stage 2) which retags them.
   # ================
-  release_binaries:
-    name: Release Binaries
+  release:
+    name: Release
     needs: test
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
     steps:
-      - name: Check out code
-        uses: actions/checkout@v5
+      - name: Checkout
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - name: goreleaser
-        if: success()
-        uses: docker://goreleaser/goreleaser:latest
-        env:
-          GITHUB_USER: ${{ github.repository_owner }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GOTOOLCHAIN: auto
+      - name: Set up Go
+        uses: actions/setup-go@v6
         with:
-          args: release --config .github/goreleaser.yml
-  # ================
-  # RELEASE DOCKER IMAGES (on push "v*" tag)
-  # ================
-  release_docker:
-    name: Release Docker Images
-    needs: test
-    if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v5
+          go-version: stable
+          cache: true
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/setup-buildx-action@v4
+      - name: Login to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
         with:
           username: jpillora
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: jpillora/chisel
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
         with:
-          context: .
-          file: .github/Dockerfile
-          platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/386,linux/arm/v7,linux/arm/v6
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          distribution: goreleaser
+          version: v2.12.7
+          args: release --clean --config .github/goreleaser.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/promote.yml

@@ -0,0 +1,56 @@
+name: Promote
+# ================
+# RELEASE STAGE 2 (on publishing the draft GitHub release)
+# Promotes the version-tagged multi-arch Docker manifests pushed by
+# stage 1 (ci.yml release job) to latest / X / X.Y on GHCR and
+# Docker Hub. Pure manifest copy — nothing is rebuilt.
+# ================
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to promote (e.g. v1.12.0)'
+        required: true
+permissions:
+  contents: read
+jobs:
+  docker-tags:
+    name: Promote Docker tags
+    # prereleases keep only their version tag; manual dispatch is an
+    # explicit operator override
+    if: ${{ github.event_name == 'workflow_dispatch' || !github.event.release.prerelease }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Login to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: jpillora
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Retag version manifests to latest / major / major.minor
+        env:
+          TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: |
+          set -euo pipefail
+          VERSION="${TAG#v}"
+          MAJOR="${VERSION%%.*}"
+          REST="${VERSION#*.}"
+          MINOR="${REST%%.*}"
+          echo "promoting ${VERSION} -> latest, ${MAJOR}, ${MAJOR}.${MINOR}"
+          for repo in ghcr.io/jpillora/chisel docker.io/jpillora/chisel; do
+            docker buildx imagetools create \
+              --tag "${repo}:latest" \
+              --tag "${repo}:${MAJOR}" \
+              --tag "${repo}:${MAJOR}.${MINOR}" \
+              "${repo}:${VERSION}"
+          done