The release process is regenerating binaries.

[Vad1mo]

The current release process is using goreleaser to make the binaries, on the other hand when we create the images for the harbor-cli, we are rebuilding the binaries. IMO it would make sense to reuse the binaries instead of regenerating them.

• same process
• same signatures and hashes of generated binaries.

[bupd]

It seems we can use goreleaser to create docker images too.

• https://goreleaser.com/customization/docker/
• https://goreleaser.com/customization/sbom/

[bupd]

Also we can use goreleaser to publish to AUR and homebrew too.

[bupd]

I am brainstorming here.

instead of building binaries inside dagger, We can update the Release pipeline to use the binaries generated by the goreleaser and package them into containers created by dagger. so we can use the same sbom. too

[danish9039]

hi @bupd @Vad1mo , i want to work on this issue , so the expected outcome will be using the binaries created by goreleaser and package them into the containers created by dagger using same sbom ?

[bupd]

@danish9039
yes, create binaries and sbom with goreleaser, and publish to github release.

for the dagger part, we should use the binary from goreleaser. and attach the sbom to the container.

[danish9039]

@bupd ,
I’ve completed the initial implementation for this PR and would really appreciate your review and any guidance you can share.
Please let me know if there’s anything I should improve or if I’ve missed something. Thanks in advance!

[Shrey023]

Hi! I’d like to take this issue as part of my LFX mentorship prep. I’ve setup Harbor locally and I'm exploring CLI internals. Will proceed with using goreleaser binaries in the Dagger container as discussed. Let me know if there’s anything to keep in mind before I begin.