Hermetic Builds 🔒 (#40)

* more hermetic builds

* match go versions

* run `script/update`

* Fix shebang formatting in env script

* Refactor build environment variables and ldflags in .goreleaser.yaml

* goreleaser updates

* fix build

* add check

* Update build scripts to use single target mode and pass arguments to goreleaser

Author: GrantBirki

.github/workflows/build.yml

@@ -23,5 +23,14 @@ jobs:
           go-version-file: 'go.mod'
           cache: true
 
+      - name: goreleaser
+        uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # pin@v6
+        with:
+          install-only: true
+
+      - name: bootstrap
+        run: script/bootstrap
+
+      # run a build in single target mode to save ci time
       - name: build
-        run: go build -v ./cmd/gh-combine
+        run: script/build --single-target

.github/workflows/golangci-lint.yml

@@ -23,5 +23,8 @@ jobs:
           go-version-file: 'go.mod'
           cache: true
 
+      - name: bootstrap
+        run: script/bootstrap
+
       - name: run golangci-lint
         uses: golangci/golangci-lint-action@v8

.github/workflows/lint.yml

@@ -23,6 +23,9 @@ jobs:
           go-version-file: 'go.mod'
           cache: true
 
+      - name: bootstrap
+        run: script/bootstrap
+
       # Taken from https://github.com/cli/cli/blob/trunk/.github/workflows/lint.yml
       - name: lint
         run: |

.github/workflows/release.yml

@@ -29,6 +29,9 @@ jobs:
           go-version-file: "go.mod"
           cache: false
 
+      - name: bootstrap
+        run: script/bootstrap
+
       - name: goreleaser
         uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # pin@v6
         with:

.github/workflows/test.yml

@@ -23,5 +23,8 @@ jobs:
           go-version-file: 'go.mod'
           cache: true
 
+      - name: bootstrap
+        run: script/bootstrap
+
       - name: test
         run: script/test

.goreleaser.yaml

@@ -3,31 +3,56 @@
 
 version: 2
 
-before:
-  hooks:
-    - go mod tidy
-
 builds:
-  - main: ./cmd/gh-combine
+  - main: ./cmd/gh-combine # Default: `.`.
+    dir: "."
+    binary: gh-combine # Default: Project directory name.
     env:
       - CGO_ENABLED=0
+      - GOPROXY=off
+      - GOSUMDB=off
+      - SOURCE_DATE_EPOCH={{ .CommitTimestamp }}
+    flags:
+      - -trimpath
+      - -mod=vendor
+      - -v
     goos:
       - linux
       - darwin
+      - windows
+      - freebsd
     ldflags:
-      - -s -w -X github.com/github/gh-combine/internal/version.tag={{.Tag}}
+      - -s -w -X github.com/github/gh-combine/internal/version.tag={{.Tag}} -X github.com/github/gh-combine/internal/version.commit={{.FullCommit}} -X github.com/github/gh-combine/internal/version.buildTime={{.CommitDate}}
 
 archives:
-  - name_template: "{{ .Os }}-{{ .Arch }}"
-    format: binary
-
+  - formats:
+      - binary
+    meta: true
+    # Archive name.
+    #
+    # Default:
+    # - if format is `binary`:
+    #   - `{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}`
+    # - if format is anything else:
+    #   - `{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}`
+    # Templates: allowed.
+    name_template: '{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}'
+
+# snapshots are used for testing and development purposes
+# build snapshots with `goreleaser build --snapshot --clean`
 snapshot:
-  name_template: "{{ .Tag }}-next"
+  version_template: "{{ .Version }}-dev-{{.ShortCommit}}"
+
+checksum:
+  name_template: "checksums.txt"
 
 changelog:
   use: github-native
 
+report_sizes: true
+
 release:
   draft: false
+  include_meta: true
 
 dist: "./dist"

go.mod

@@ -1,36 +1,34 @@
 module github.com/github/gh-combine
 
-go 1.23.0
-
-toolchain go1.23.8
+go 1.23.8
 
 require github.com/briandowns/spinner v1.23.2
 
 require (
-	github.com/cli/go-gh/v2 v2.12.1
+	github.com/cli/go-gh/v2 v2.12.2
 	github.com/cli/shurcooL-graphql v0.0.4
 	github.com/spf13/cobra v1.9.1
 	github.com/stretchr/testify v1.10.0
 )
 
 require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
-	github.com/cli/safeexec v1.0.0 // indirect
+	github.com/cli/safeexec v1.0.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/fatih/color v1.7.0 // indirect
-	github.com/henvic/httpretty v0.0.6 // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/henvic/httpretty v0.1.4 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/kr/pretty v0.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
-	github.com/thlib/go-timezone-local v0.0.0-20210907160436-ef149e42d28e // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/term v0.30.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
+	github.com/thlib/go-timezone-local v0.0.7 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/term v0.34.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -2,21 +2,21 @@ github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiE
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/briandowns/spinner v1.23.2 h1:Zc6ecUnI+YzLmJniCfDNaMbW0Wid1d5+qcTq4L2FW8w=
 github.com/briandowns/spinner v1.23.2/go.mod h1:LaZeM4wm2Ywy6vO571mvhQNRcWfRUnXOs0RcKV0wYKM=
-github.com/cli/go-gh/v2 v2.12.1 h1:SVt1/afj5FRAythyMV3WJKaUfDNsxXTIe7arZbwTWKA=
-github.com/cli/go-gh/v2 v2.12.1/go.mod h1:+5aXmEOJsH9fc9mBHfincDwnS02j2AIA/DsTH0Bk5uw=
-github.com/cli/safeexec v1.0.0 h1:0VngyaIyqACHdcMNWfo6+KdUYnqEr2Sg+bSP1pdF+dI=
-github.com/cli/safeexec v1.0.0/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=
+github.com/cli/go-gh/v2 v2.12.2 h1:EtocmDAH7dKrH2PscQOQVo7PbFD5G6uYx4rSKY2w1SY=
+github.com/cli/go-gh/v2 v2.12.2/go.mod h1:g2IjwHEo27fgItlS9wUbRaXPYurZEXPp1jrxf3piC6g=
+github.com/cli/safeexec v1.0.1 h1:e/C79PbXF4yYTN/wauC4tviMxEV13BwljGj0N9j+N00=
+github.com/cli/safeexec v1.0.1/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=
 github.com/cli/shurcooL-graphql v0.0.4 h1:6MogPnQJLjKkaXPyGqPRXOI2qCsQdqNfUY1QSJu2GuY=
 github.com/cli/shurcooL-graphql v0.0.4/go.mod h1:3waN4u02FiZivIV+p1y4d0Jo1jc6BViMA73C+sZo2fk=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 h1:2VTzZjLZBgl62/EtslCrtky5vbi9dd7HrQPQIx6wqiw=
 github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542/go.mod h1:Ow0tF8D4Kplbc8s8sSb3V2oUCygFHVp8gC3Dn6U4MNI=
-github.com/henvic/httpretty v0.0.6 h1:JdzGzKZBajBfnvlMALXXMVQWxWMF/ofTy8C3/OSUTxs=
-github.com/henvic/httpretty v0.0.6/go.mod h1:X38wLjWXHkXT7r2+uK8LjCMne9rsuNaBLJ+5cU2/Pmo=
+github.com/henvic/httpretty v0.1.4 h1:Jo7uwIRWVFxkqOnErcoYfH90o3ddQyVrSANeS4cxYmU=
+github.com/henvic/httpretty v0.1.4/go.mod h1:Dn60sQTZfbt2dYsdUSNsCljyF4AfdqnuJFDLJA1I4AM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
@@ -26,9 +26,8 @@ github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
@@ -40,21 +39,23 @@ github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUc
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/thlib/go-timezone-local v0.0.0-20210907160436-ef149e42d28e h1:BuzhfgfWQbX0dWzYzT1zsORLnHRv3bcRcsaUk0VmXA8=
-github.com/thlib/go-timezone-local v0.0.0-20210907160436-ef149e42d28e/go.mod h1:/Tnicc6m/lsJE0irFMA0LfIwTBo4QP7A8IfyIv4zZKI=
+github.com/thlib/go-timezone-local v0.0.7 h1:fX8zd3aJydqLlTs/TrROrIIdztzsdFV23OzOQx31jII=
+github.com/thlib/go-timezone-local v0.0.7/go.mod h1:/Tnicc6m/lsJE0irFMA0LfIwTBo4QP7A8IfyIv4zZKI=
 golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
-golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
+golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/version/version.go

@@ -6,9 +6,9 @@ import (
 )
 
 var (
-	tag    = "dev" // set via ldflags
-	commit = "123abc"
-	date   = "now"
+	tag       = "dev" // set via ldflags
+	commit    = "123abc"
+	buildTime = "now"
 )
 
 const template = "%s (%s) built at %s\nhttps://github.com/github/gh-combine/releases/tag/%s"
@@ -22,18 +22,22 @@ func defaultBuildInfoReader() (*debug.BuildInfo, bool) {
 }
 
 func String() string {
-	info, ok := buildInfoReader()
+	// Start with ldflags values
+	currentCommit := commit
+	currentDate := buildTime
 
+	// Override with VCS info if available and ldflags weren't set
+	info, ok := buildInfoReader()
 	if ok {
 		for _, setting := range info.Settings {
-			if setting.Key == "vcs.revision" {
-				commit = setting.Value
+			if setting.Key == "vcs.revision" && commit == "123abc" {
+				currentCommit = setting.Value
 			}
-			if setting.Key == "vcs.time" {
-				date = setting.Value
+			if setting.Key == "vcs.time" && buildTime == "now" {
+				currentDate = setting.Value
 			}
 		}
 	}
 
-	return fmt.Sprintf(template, tag, commit, date, tag)
+	return fmt.Sprintf(template, tag, currentCommit, currentDate, tag)
 }

internal/version/version_test.go

@@ -9,14 +9,14 @@ func TestString(t *testing.T) {
 	// Save original values
 	origTag := tag
 	origCommit := commit
-	origDate := date
+	origBuildTime := buildTime
 	origBuildInfoReader := buildInfoReader
 
 	// Restore original values after the test
 	defer func() {
 		tag = origTag
 		commit = origCommit
-		date = origDate
+		buildTime = origBuildTime
 		buildInfoReader = origBuildInfoReader
 	}()
 
@@ -25,7 +25,7 @@ func TestString(t *testing.T) {
 		// Set known values for testing
 		tag = "v1.0.0"
 		commit = "abc123"
-		date = "2025-04-15"
+		buildTime = "2025-04-15"
 
 		// Mock the buildInfoReader to return false so that preset values are used
 		buildInfoReader = func() (*debug.BuildInfo, bool) {
@@ -43,10 +43,10 @@ func TestString(t *testing.T) {
 
 	// Test 2: With mock build info that updates commit and date
 	t.Run("with mock build info", func(t *testing.T) {
-		// Set initial values
+		// Set sentinel values so VCS info will override
 		tag = "dev"
-		commit = "initial-commit"
-		date = "initial-date"
+		commit = "123abc"
+		buildTime = "now"
 
 		// Create mock build info with specific values
 		mockSettings := []debug.BuildSetting{
@@ -75,7 +75,7 @@ func TestString(t *testing.T) {
 		// Set initial values
 		tag = "dev"
 		commit = "unchanged-commit"
-		date = "unchanged-date"
+		buildTime = "unchanged-date"
 
 		// Empty build settings
 		buildInfoReader = func() (*debug.BuildInfo, bool) {
@@ -92,4 +92,32 @@ func TestString(t *testing.T) {
 			t.Errorf("Expected version string to be:\n%q\nbut got:\n%q", expected, result)
 		}
 	})
+
+	// Test 4: ldflags values should take precedence over VCS info
+	t.Run("ldflags precedence over vcs", func(t *testing.T) {
+		// Set non-sentinel values (simulating ldflags)
+		tag = "v2.0.0"
+		commit = "ldflags-commit"
+		buildTime = "ldflags-time"
+
+		// VCS info that should be ignored
+		mockSettings := []debug.BuildSetting{
+			{Key: "vcs.revision", Value: "vcs-commit-hash"},
+			{Key: "vcs.time", Value: "vcs-build-time"},
+		}
+
+		buildInfoReader = func() (*debug.BuildInfo, bool) {
+			return &debug.BuildInfo{
+				Settings: mockSettings,
+			}, true
+		}
+
+		result := String()
+
+		// ldflags values should be used, not VCS
+		expected := "v2.0.0 (ldflags-commit) built at ldflags-time\nhttps://github.com/github/gh-combine/releases/tag/v2.0.0"
+		if result != expected {
+			t.Errorf("Expected version string to be:\n%q\nbut got:\n%q", expected, result)
+		}
+	})
 }