ci: publish multi-arch images to ghcr.io

goreleaser's dockers_v2 assembles the manifest from the binaries it already
built, so the image is a COPY of a static binary and the repo keeps one
version-stamping path.

The final stage runs nothing: a RUN would need QEMU to execute a non-native
arch under buildx, so the cert bundle is copied out of a BUILDPLATFORM stage
instead. Alpine over distroless keeps a shell, which the image needs to serve
as a CI job image.

Beta releases take :latest — nothing stabler is published yet.

beep boop

Author: khvn26

.github/workflows/release.yml

@@ -12,6 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write # upload release artifacts
+      packages: write # push to ghcr.io
       id-token: write # attest artifacts
       attestations: write
     steps:
@@ -22,6 +23,12 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           version: "~> v2"
@@ -32,3 +39,6 @@ jobs:
       - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
           subject-checksums: ./dist/checksums.txt
+      - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        with:
+          subject-checksums: ./dist/digests.txt

.goreleaser.yaml

@@ -34,6 +34,27 @@ archives:
 checksum:
   name_template: checksums.txt
 
+docker_digest:
+  name_template: digests.txt
+
+dockers_v2:
+  - images:
+      - ghcr.io/flagsmith/flagsmith-cli
+    tags:
+      - "{{ .Tag }}"
+      - "{{ .Version }}"
+      # Beta releases still take :latest — nothing stabler is published yet.
+      - latest
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    labels:
+      # Links the ghcr package to this repo.
+      org.opencontainers.image.source: https://github.com/Flagsmith/flagsmith-cli
+      org.opencontainers.image.version: "{{ .Tag }}"
+      org.opencontainers.image.revision: "{{ .FullCommit }}"
+      org.opencontainers.image.licenses: MIT
+
 # changelog handled by release-please.
 changelog:
   disable: true

Dockerfile

@@ -0,0 +1,9 @@
+FROM --platform=$BUILDPLATFORM alpine:3 AS certs
+RUN apk add --no-cache ca-certificates
+
+FROM alpine:3
+ARG TARGETPLATFORM
+COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY $TARGETPLATFORM/flagsmith /usr/local/bin/flagsmith
+WORKDIR /work
+ENTRYPOINT ["flagsmith"]

README.md

@@ -8,6 +8,14 @@ The next-generation Flagsmith command-line interface (work in progress).
 go build -o flagsmith .
 ```
 
+## Docker
+
+```sh
+docker run --rm -v "$PWD:/work" -e FLAGSMITH_API_KEY ghcr.io/flagsmith/flagsmith-cli flag list
+```
+
+A container has no keyring, so `flagsmith login` cannot store credentials there — pass `FLAGSMITH_API_KEY` or `FLAGSMITH_ENVIRONMENT_KEY`.
+
 ## Quickstart
 
 ```sh