Introdução ao GoReleaser

Apresentado no meetup Hacktoberfest Brasil de Go em 28/10/2021.

1. INTRODUÇÃO AO GORELEASER 1 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
2. QUEM SOU EU? > SRE @ totvslabs > @caarlos0 almost everywhere > carlosbecker.dev/talks/ > goreleaser.com > nfpm.goreleaser.com 2 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
3. O QUE É O GORELEASER? > ferramenta de automação que faz build e release the software escrito em Go > você configura uma vez via yaml > e faz uma release quando quiser com git tag + goreleaser release 3 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
4. O QUE ELE FAZ? > build pra uma matrix de GOOS, GOARCH, GOARM, etc > cria macOS universal binaries > cria arquivos em diversos formatos pra cada plataforma 4 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
5. O QUE ELE FAZ? > cria pacotes linux: deb, rpm, apk, snap > cria homebrew taps, gofish rigs e scoop buckets > cria e assina images e manifestos docker 5 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
6. O QUE ELE FAZ? > cria arquivos de checksum > assina arquivos > upload dos arquivos para artifactory, Fury, blob, ou qualquer outra coisa que aceite requests PUT 6 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
7. O QUE ELE FAZ? > cria releases no GitHub/GitLab/Gitea (com changelog) > roda "custom publishers" (aka shell scripts) > anuncia as releases em diversos lugares 7 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
8. O QUE ELE FAZ? Tudo integrado no seu CI favorito! GitHub Actions, Azure Pipelines, CircleCI, Google CloudBuild, GitLab CI and many others... Exemplos: goreleaser.com/ci 8 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
9. VAMOS COMO FUNCIONA NA PRÁTICA! 9 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
10. <DEMO> 10 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
11. O QUE VAMOS FAZER? > setup inicial de um projeto > configurar changelogs melhores > go mod proxying > universal macOS binaries > linux packaging > docker images > assinar artefatos com cosign 11 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
12. SETUP INICIAL 12 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
13. SETUP INICIAL mkdir example-hacktoberfest cd example-hacktoberfest git init gh repo create caarlos0/example-hacktoberfest -y -l MIT git pull origin main 13 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
14. SETUP INICIAL Inicializar ele como um Go module: go mod init github.com/caarlos0/example-hacktoberfest E criar um main.go simples: package main import ( "fmt" ) func main() { fmt.Println("olá hacktoberfest brasil!") } 14 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
15. SETUP INICIAL Próximo passo: como saber se nosso arquivo .goreleaser.yml é válido e funciona: goreleaser -h goreleaser init goreleaser check goreleaser release -h goreleaser release --rm-dist --snapshot 15 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
16. SETUP INICIAL Por fim, vamos fazer uma release de verdade: git add -A git commit -am 'feat: first commit' git tag v1.0.0 git push origin HEAD --tags goreleaser release --rm-dist gh release view v1.0.0 -w 16 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
17. BETTER CHANGELOG 17 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
18. CHANGELOGS MELHORES changelog: use: github sort: asc filters: exclude: - '^docs:' - '^test:' 18 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
19. BETTER CHANGELOG Agora uma release pra testar isso ai: git commit -am 'ci: changelog' git tag `svu n --force-patch-increment` git push origin HEAD --tags goreleaser release --rm-dist ./dist/example-hacktoberfest_darwin_amd64/example-hacktoberfest 19 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
20. GO MOD PROXY 20 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
21. GO MOD PROXY Go mod proxying faz com que os binários sejam compilados a partir do source que esta no proxy.golang.org. Com isso, o binário pode ser verificado com go versiom -m, mostrando os checksums do seu repo, dependencias e versao do Go usada. 21 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
22. GO MOD PROXY Pra usar isso, precisamos habilitar a feature no .goreleaser.yml: # ... gomod: proxy: true env: - GOPRIVATE=github.com/caarlos0 # ... 22 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
23. GO MOD PROXY Aí, também podemos pegar as versões das coisas no nosso main usando runtime/ debug: package main import ( "fmt" "runtime/debug" ) func main() { fmt.Println("hello golang community") if info, ok := debug.ReadBuildInfo(); ok { fmt.Println(info.Main.Path, info.Main.Version, info.Main.Sum) } } 23 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
24. GO MOD PROXY Vamos testar o que acontece quando não compilamos por a partir do proxy: go build . go version -m example-hacktoberfest ./example-hacktoberfest 24 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
25. GO MOD PROXY Agora vamos fazer uma release e testar a mesma coisa: git commit -am 'ci: go mod proxy' git tag `svu n --force-patch-increment` git push origin HEAD --tags goreleaser release --rm-dist go version -m ./dist/example-hacktoberfest_darwin_amd64/example-hacktoberfest ./dist/example-hacktoberfest_darwin_amd64/example-hacktoberfest 25 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
26. UNIVERSAL MACOS BINARIES 26 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
27. UNIVERSAL MACOS BINARIES Basicamente, combina os binários pra M1 e Intel em um único binário. PS: go version -m não funciona nesse binário. 27 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
28. UNIVERSAL MACOS BINARIES Apenas precisamos habilitar a funcionalidade com: # ... universal_binaries: - replace: true # ... 28 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
29. UNIVERSAL MACOS BINARIES E podemos fazer outra release pra testar: git commit -am 'ci: universal binaries' git tag `svu n --force-patch-increment` git push origin HEAD --tags goreleaser release --rm-dist ./dist/example-hacktoberfest_darwin_all/example-hacktoberfest 29 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
30. LINUX PACKAGES 30 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
31. LINUX PACKAGES Configuração mínima: # ... nfpms: - formats: [deb, apk, rpm] # ... 31 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
32. LINUX PACKAGES E release: git commit -am 'ci: nfpm packages' git tag `svu n --force-patch-increment` git push origin HEAD --tags goreleaser release --rm-dist tree dist 32 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
33. LINUX PACKAGES Vamos testar: docker run --rm -v $PWD/dist:/tmp/ alpine sh -c \ 'apk add -q --allow-untrusted /tmp/*_amd64.apk && example-hacktoberfest' docker run --rm -v $PWD/dist:/tmp/ ubuntu sh -c \ 'dpkg -i /tmp/*_amd64.deb && example-hacktoberfest' docker run --rm -v $PWD/dist:/tmp/ fedora sh -c \ 'rpm -i /tmp/*_amd64.rpm && example-hacktoberfest' 33 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
34. DOCKER IMAGES 34 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
35. DOCKER IMAGES Configuração mínima: # ... dockers: - image_templates: - caarlos0/{{ .ProjectName }}:{{ .Tag }} - caarlos0/{{ .ProjectName }}:latest # ... 35 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
36. DOCKER IMAGES Um Dockerfile: FROM alpine COPY *.apk /tmp/ RUN apk add --allow-untrusted /tmp/*.apk ENTRYPOINT ["/usr/local/bin/example-hacktoberfest"] 36 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
37. DOCKER IMAGES Release: git add -A git commit -am 'ci: docker imgs' git tag `svu n --force-patch-increment` git push origin HEAD --tags goreleaser release --rm-dist 37 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
38. DOCKER IMAGES Testando: docker run --rm caarlos0/example-hacktoberfest 38 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
39. ASSINANDO COM COSIGN 39 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
40. ASSINANDO COM COSIGN Cosign é uma alternativa mais simples de usar ao GPG, e também consegue assinar imagens e manifestos Docker! O primeiro passo é gerar as chaves: cosign generate-key-pair 40 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
41. ASSINANDO COM COSIGN # ... signs: - artifacts: checksum stdin: '{{ .Env.COSIGN_PWD }}' cmd: cosign args: ["sign-blob", "-key=cosign.key", "-output=${signature}", "${artifact}"] docker_signs: - artifacts: images stdin: '{{ .Env.COSIGN_PWD }}' # ... 41 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
42. ASSINANDO COM COSIGN Release: git add -A git commit -am 'ci: sign' git tag `svu n --force-patch-increment` git push origin HEAD --tags COSIGN_PWD=asd goreleaser release --rm-dist 42 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
43. ASSINANDO COM COSIGN Agora podemos verificar as assinaturas com o comando cosign e os checksums com o comando sha256sum: cosign verify-blob -key cosign.pub \ -signature dist/checksums.txt.sig \ dist/checksums.txt cd dist; sha256sum --ignore-missing -c checksums.txt; cd - 43 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
44. ASSINANDO COM COSIGN Também podemos verificar a imagem Docker: cosign verify -key cosign.pub \ caarlos0/example-hacktoberfest:latest 44 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
45. </DEMO> 45 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
46. CONTRIBUINDO 46 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
47. CONTRIBUINDO Afinal, é Hacktoberfest! > sempre tem algum bug pra corrigir, feature pra implementar, PR pra revisar, pergunta pra responder... ! > Toda ajuda é muito bem-vinda! > github.com/goreleaser 47 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
48. APRENDENDO MAIS 48 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
49. APRENDENDO MAIS Tem muita documentação, exemplos, cookbooks e etc no site: > goreleaser.com 49 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
50. 50 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/
51. THANKS! 51 — Go Community Monthly @ Hacktoberfest Brasil - October, 2021 - carlosbecker.dev/talks/