feat: separated CI workflow and added GoReleaser configuration to add release tags automated by atharvamhaske · Pull Request #98 · sugar-org/swarm-external-secrets

atharvamhaske · 2026-03-13T18:57:35Z

Summary

Introduced CI workflow for building, testing, and releasing the plugin.
Added GoReleaser configuration for automated builds and releases.
Created tagging workflow to manage versioning based on successful smoke tests.
Updated release workflow to streamline Docker plugin publishing to GitHub Container Registry and Docker Hub.

Type of change

Mention the secrets provider

Description

In this PR separated the CI logic in new file CI.yml and now our release.yml is pure release pipeline which builds multi-platform binaries also goreleaser generates SPDX and CylconeDX SBOMs, produces checksum.txt for safe rollbacks and attests the checksums.txt with Sigstore via actions/attest-build-provenance, enabling users to verify the build chain with gh attestation verify.

Also docker-plugin builds and pushes docker managed plugin to both of GHCR and DockerHub tagged with exact versions.

Now the release notes includes a structured changelog grouped by commit conventions(bug fixs, docs) as well as github's auto generated "What's Changed" and "New Contributors" sections

Note: We have to now add PAT of Github with write access as normal GITHUB_TOKEN doesn't have access to handle downstream workflows

This was big issue to work on and had great experience in learning and im open for any feedback, suggestions for improvements.

Commands & Configuration to test

NA

Screenshots & Logs

Related Tickets & Documents

Related Issue #
Closes Implement version releases with artifacts #18

Was this PR authored or co-authored using generative AI tooling?

Nope, I have used AI for some learning purposes and i have mostly took help of other popular open source projects which has CI workflows along with go-release.

References:

https://github.com/safedep/pmg/blob/main/.github/workflows/ci.yml
https://github.com/safedep/pmg/blob/main/.github/workflows/goreleaser.yml
https://github.com/gohugoio/hugo/blob/master/hugoreleaser.yaml

- Introduced CI workflow for building, testing, and releasing the plugin. - Added GoReleaser configuration for automated builds and releases. - Created tagging workflow to manage versioning based on successful smoke tests. - Updated release workflow to streamline Docker plugin publishing to GitHub Container Registry and Docker Hub.

- Changed SPDX and CycloneDX document names to include the .json extension for clarity.

atharvamhaske · 2026-03-13T19:08:48Z

@sanjay7178 review this once via copilot all good from my side by this new workflow we can release our first release version as v0.1.0 or v1.0.0

Copilot

Pull request overview

This PR refactors GitHub Actions pipelines to separate CI from release automation and introduces GoReleaser configuration to generate multi-arch artifacts, SBOMs, checksums, and provenance attestations, with an automated tag-on-success flow after smoke tests (Issue #18).

Changes:

Added .goreleaser.yaml for multi-arch builds, checksums, SBOM generation, and structured changelog/release notes.
Added a new CI workflow (ci.yml) and a tag automation workflow (tag-release.yml) driven by the existing “Smoke Tests” workflow.
Updated release.yml to run on version tags, run GoReleaser, attest checksums provenance, and publish the Docker managed plugin to GHCR/Docker Hub.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File	Description
`.goreleaser.yaml`	New GoReleaser configuration for artifacts, SBOMs, checksums, and changelog grouping.
`.github/workflows/ci.yml`	New CI workflow to build/test, run a GoReleaser snapshot, and validate Docker plugin creation.
`.github/workflows/tag-release.yml`	New workflow to automatically create a semver tag after successful smoke tests.
`.github/workflows/release.yml`	Release workflow now triggers on tags, runs GoReleaser, creates provenance attestations, and publishes Docker plugins.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.goreleaser.yaml

+      regexp: '^.*?feat(\([[:word:]]+\))??!?:.+$'
+      order: 0
+    - title: "Bug Fixes"
+      regexp: '^.*?fix(\([[:word:]]+\))??!?:.+$'
+      order: 1
+    - title: "Documentation"
+      regexp: '^.*?docs(\([[:word:]]+\))??!?:.+$'
+      order: 2
+    - title: "Performance"
+      regexp: '^.*?perf(\([[:word:]]+\))??!?:.+$'
+      order: 3
+    - title: "Refactor"
+      regexp: '^.*?refactor(\([[:word:]]+\))??!?:.+$'
+      order: 4
+    - title: "CI/Build"
+      regexp: '^.*?(ci|build)(\([[:word:]]+\))??!?:.+$'


.github/workflows/tag-release.yml

+
+      - uses: mathieudutour/github-tag-action@d28fa2ccfbd16e871a4bdf35e11b3ad1bd56c0c1 # v6.2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}


.github/workflows/release.yml

@@ -75,43 +95,24 @@ jobs:
      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: ${{ env.DOCKERHUB_USERNAME }}
+          password: ${{ env.DOCKERHUB_TOKEN }}



.github/workflows/release.yml

+      - name: Build and push plugin
        env:
-          PLUGIN_NAME: ghcr.io/${{ github.repository_owner }}/swarm-external-secrets
-          DOCKERHUB_PLUGIN_NAME: ${{ secrets.DOCKERHUB_USERNAME }}/swarm-external-secrets
-          PLUGIN_VERSION: ${{ github.event.inputs.version }}
+          VERSION: ${{ github.ref_name }}
+          GHCR: ghcr.io/${{ github.repository_owner }}/swarm-external-secrets
+          DHR: ${{ env.DOCKERHUB_USERNAME }}/swarm-external-secrets
        run: |
-          # The build logic is based on your deploy.sh and build.sh scripts
-          docker build -t swarm-external-secrets:temp .
+          docker build -t plugin:temp .
          mkdir -p ./plugin/rootfs
-          docker create --name temp-container swarm-external-secrets:temp
-          docker export temp-container | tar -x -C ./plugin/rootfs
-          docker rm temp-container
-          docker rmi swarm-external-secrets:temp
+          docker create --name plugin-rootfs plugin:temp
+          docker export plugin-rootfs | tar -x -C ./plugin/rootfs
+          docker rm plugin-rootfs && docker rmi plugin:temp
          cp config.json ./plugin/
-
-          # Create and push to GitHub Container Registry
-          docker plugin create ${{ env.PLUGIN_NAME }}:${{ env.PLUGIN_VERSION }} ./plugin
-          docker plugin push ${{ env.PLUGIN_NAME }}:${{ env.PLUGIN_VERSION }}
-
-          docker plugin create ${{ env.PLUGIN_NAME }}:latest ./plugin
-          docker plugin push ${{ env.PLUGIN_NAME }}:latest
-
-          # Create and push to Docker Hub
-          docker plugin create ${{ env.DOCKERHUB_PLUGIN_NAME }}:${{ env.PLUGIN_VERSION }} ./plugin
-          docker plugin push ${{ env.DOCKERHUB_PLUGIN_NAME }}:${{ env.PLUGIN_VERSION }}
-
-          docker plugin create ${{ env.DOCKERHUB_PLUGIN_NAME }}:latest ./plugin
-          docker plugin push ${{ env.DOCKERHUB_PLUGIN_NAME }}:latest
-
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ github.event.inputs.version }}
-          name: Release ${{ github.event.inputs.version }}
-          body: "Official release for version ${{ github.event.inputs.version }}."
-          draft: false
-          prerelease: false
+          for IMAGE in "${GHCR}" "${DHR}"; do
+            docker plugin create ${IMAGE}:${VERSION} ./plugin
+            docker plugin push  ${IMAGE}:${VERSION}
+            docker plugin create ${IMAGE}:latest ./plugin
+            docker plugin push  ${IMAGE}:latest
+          done


.goreleaser.yaml

+    - -s -w 
+    - -X main.version={{.Version}}
+    - -X main.commit={{.Commit}}
+    - -X main.date={{.Date}}


atharvamhaske · 2026-03-13T19:25:20Z

.goreleaser.yaml

+    - -s -w 
+    - -X main.version={{.Version}}
+    - -X main.commit={{.Commit}}
+    - -X main.date={{.Date}}


@sanjay7178 here we have to edit main.go file we are just hardcoding rn

.goreleaser.yaml

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Modified the tag-release workflow to use fallbacks for GH tokens

…ng in release workflow - Added conditional check for Docker Hub credentials before login. - Refactored image handling logic to include Docker Hub images only if credentials are provided.

…nally to Docker Hub

…uration

atharvamhaske · 2026-03-13T19:45:36Z

all suggestions by copilot are solved please review once again and lmk

atharvamhaske added 3 commits March 14, 2026 00:06

fix: update SBOM document naming conventions in GoReleaser configuration

0a8bc4e

- Changed SPDX and CycloneDX document names to include the .json extension for clarity.

chore: update Docker container naming in CI and release workflows

bf87d03

sanjay7178 requested a review from Copilot March 13, 2026 19:18

Copilot started reviewing on behalf of sanjay7178 March 13, 2026 19:18 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

atharvamhaske and others added 6 commits March 14, 2026 00:53

Potential fix for pull request finding

8a23935

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

chore:

c5899d1

Modified the tag-release workflow to use fallbacks for GH tokens

chore: enhance Docker Hub login condition and streamline image handli…

a507905

…ng in release workflow - Added conditional check for Docker Hub credentials before login. - Refactored image handling logic to include Docker Hub images only if credentials are provided.

chore: update GoReleaser changelog regex patterns for breaking changes

520bfc1

chore: update release workflow to always publish to GHCR and conditio…

e06f25b

…nally to Docker Hub

chore: update versioning information in main.go and GoReleaser config…

42670e7

…uration

sanjay7178 requested a review from Sarath191181208 March 13, 2026 19:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: separated CI workflow and added GoReleaser configuration to add release tags automated#98

feat: separated CI workflow and added GoReleaser configuration to add release tags automated#98
atharvamhaske wants to merge 9 commits intosugar-org:mainfrom
atharvamhaske:go-releaser

atharvamhaske commented Mar 13, 2026

Uh oh!

atharvamhaske commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

atharvamhaske Mar 13, 2026

Uh oh!

Uh oh!

atharvamhaske commented Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

atharvamhaske commented Mar 13, 2026

Summary

Type of change

Mention the secrets provider

Description

Commands & Configuration to test

Screenshots & Logs

Related Tickets & Documents

Was this PR authored or co-authored using generative AI tooling?

References:

Uh oh!

atharvamhaske commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

atharvamhaske Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

atharvamhaske commented Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants