ci: add goreleaser

[andriygm]

this PR updates CI/CD workflows to use goreleaser for building + aggregating artifacts. it also supports homebrew tap publishing and release generation with attestations. uses zigbuild for cross-arch support within OS + simultaneously aids in linking against specific libc version without needing to build on alma.

see https://github.com/andriygm/rv/actions/runs/23328047166/job/67853966813 for alma/libc compat + build evidence.

[Keats]

I don't know goreleaser but we are losing some stuff from the current release process. What do we get from that change?

[Keats]

does that make a difference?

[andriygm]

it could go either way, I usually like to cache deps in case I need to make a patch. if the deps all change it's effectively useless.

[Keats]

we're losing that check

[andriygm]

should still be in release.yml although takes a slightly different form:

      - name: Check version matches tag
        run: |
          TAG_VERSION="${{ github.ref_name }}"
          CARGO_VERSION=$(grep '^version = ' Cargo.toml | cut -d'"' -f2)
          if [ "$TAG_VERSION" != "v$CARGO_VERSION" ]; then
            echo "Version mismatch: tag=$TAG_VERSION, Cargo.toml=v$CARGO_VERSION"
            exit 1
          fi
          echo "Version check passed: $TAG_VERSION"

I can update to use existing format, but this form can be executed earlier (before building) since it's just reading the Cargo.toml file.

[andriygm]

@Keats to answer your question, we can take advantage of some stuff it gives us "for free" for example GitHub release generation, homebrew casks, SBOMs/signing rather than needing to roll our own implementations there. I think standalone install scripts are also in the works within goreleaser, so we can take advantage of that when it comes out as well. a big headache that it resolves that is not as relevant here is generating deb/rpm packages, makes things much easier to deal with, maybe something to keep in mind for other projects though.

[dpastoor]

i'm not sure about this for rv - in particular i generally agree with standardizing, particularly across our other projects using goreleaser, but also as of now rv's release process "just works" - we don't need the rpm/debs for now, and we'd need to add more checks around our builds properly working against older os's that we know currently works with the alma build vs the cross compiling that should...in theory work, but we don't know.

I'd be more inclined to just keep as is until we have a convincing case to update, eg if we want to add more release components then do it then. We also really can remove our homebrew tap and really should start pointing people to the fact that rv is now in homebrew core as https://formulae.brew.sh/formula/rv-r

[andriygm]

@dpastoor yep fair point, can definitely leave this around if/when we need it. it might be good to add the checks you're describing even if we don't end up merging. afaik rv is only linking against libc dynamically, which is what enables us to take advantage of cargo-zigbuild, but agreed that there may be edge cases within it's implementation we would need to test for. there's also no reason we can't use this build system without zigbuild -- we can still build per target within alma8 if we want that option.