Add secure release automation with GoReleaser

[jakec-dev]

Summary

This PR implements a comprehensive release automation system using GoReleaser v2, with a focus on security
and OpenSSF Scorecard compliance. The implementation follows best practices from major Go open source
projects like Kubernetes and Docker.

What's Changed

GoReleaser Configuration

• Added .goreleaser.yml with GoReleaser v2 syntax
• Configured multi-platform builds (Linux, macOS, Windows) for all architectures
• Enabled artifact signing with cosign (keyless mode)
• Added SBOM generation for supply chain transparency
• Configured draft releases for manual review before publishing

Release Workflows

• .github/workflows/release-manual.yml: Secure manual release trigger
  • Version validation and semantic versioning enforcement
  • Automated testing before release
  • Tag creation by workflow (not humans)
  • Full GoReleaser pipeline execution
• .github/workflows/release.yml: Automated SLSA provenance generation
  • Triggered by tags created from manual workflow
  • Generates .intoto.jsonl files for maximum OpenSSF score

Build System Updates

• Makefile: Added release tools to install target
  • goreleaser v2.9.0
  • cosign v2.5.0 (artifact signing)
  • syft v1.26.1 (SBOM generation)
• All tools use pinned versions for reproducibility

Documentation

• CONTRIBUTING.md: Updated with secure release process
  • Clear separation of contributor vs maintainer workflows
  • Step-by-step release instructions
  • Security artifact documentation
• docs/RELEASE_SETUP.md: New comprehensive guide for maintainers
  • GitHub protection rules setup
  • Tag protection via rulesets
  • Troubleshooting and monitoring

Security Improvements

This implementation achieves maximum OpenSSF Scorecard rating for Signed-Releases:

Release Process Overview

graph LR
    A[Maintainer] -->|Triggers| B[Release Workflow]
    B --> C[Validate Version]
    C --> D[Run Tests]
    D --> E[Create Tag]
    E --> F[Build Artifacts]
    F --> G[Sign & Generate SBOMs]
    G --> H[Create Draft Release]
    H --> I[Generate SLSA Provenance]
    I --> J[Maintainer Reviews & Publishes]

Loading

Breaking Changes

None - this only affects the release process, not the codebase functionality.

Testing

• Validated GoReleaser configuration with goreleaser check
• Tested snapshot builds with make release-snapshot
• Verified all artifact generation in local testing

Checklist

• GoReleaser v2 configuration implemented
• Secure release workflows created
• Artifact signing with cosign configured
• SBOM generation enabled
• SLSA provenance workflow added
• Documentation updated
• Tools added to Makefile
• Branch/tag protection guide created

Next Steps

Maintainers should:

1. Review docs/RELEASE_SETUP.md
2. Configure GitHub branch and tag protection rules
3. Test the release process with a pre-release version

Closes #13