chore(release): migrate to `dockers_v2` from GoReleaser 2.12

[aofei]

Migrate from the legacy dockers configuration to the new dockers_v2 format introduced in GoReleaser 2.12^1.

The migration eliminates the need for the docker_manifests section entirely and streamlines the Dockerfile by using TARGETPLATFORM for multi-arch builds instead of architecture-specific tarball handling.

[gemini-code-assist[bot]]

Summary of Changes

Hello @aofei, I'm Gemini Code Assist[^1]! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request modernizes the project's release pipeline by upgrading the GoReleaser configuration to utilize the dockers_v2 feature. This change significantly simplifies the Docker image build and publishing process, particularly for multi-architecture images, by consolidating configurations and improving efficiency. The update ensures compatibility with newer GoReleaser versions and reduces configuration overhead.

Highlights

• GoReleaser Configuration Update: The pull request migrates the GoReleaser configuration from the legacy dockers and docker_manifests sections to the new dockers_v2 format, aligning with GoReleaser 2.12 best practices.
• Streamlined Multi-Architecture Builds: The Dockerfile has been updated to leverage the TARGETPLATFORM build argument, simplifying the handling of multi-architecture artifacts and eliminating the need for architecture-specific tarball paths.
• Environment Variable for Docker Image Repository: A new environment variable, DOCKER_IMAGE_REPO, has been introduced in the GoReleaser configuration, providing more flexibility for specifying the Docker image repository.
• Removal of Docker Manifests Section: The explicit docker_manifests section is no longer required, as the dockers_v2 configuration inherently handles the creation of multi-architecture manifests.

Ignored Files

• Ignored by pattern: .github/workflows/** (1)
  • .github/workflows/release-build.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with :thumbsup: and :thumbsdown: on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

[^1]: Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

[codecov[bot]]

Codecov Report

:white_check_mark: All modified and coverable lines are covered by tests. :white_check_mark: Project coverage is 93.98%. Comparing base (5854e57) to head (86088d0). :warning: Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2512   +/-   ##
=======================================
  Coverage   93.98%   93.98%           
=======================================
  Files          34       34           
  Lines        9613     9613           
=======================================
  Hits         9035     9035           
  Misses        413      413           
  Partials      165      165           

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

:rocket: New features to boost your workflow:

• :snowflake: Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[xgopilot[bot]]

The migration to dockers_v2 is well-executed and follows GoReleaser 2.12 best practices. However, several critical issues need attention before merge, particularly around the TARGETPLATFORM directory structure and the overly broad extra_files configuration.

[xgopilot[bot]]

Additional Security Recommendations:

1. Dockerfile - Non-root user: Consider running the container as a non-privileged user instead of root. Add before the final stage completes:

   RUN groupadd -r xgo && useradd -r -g xgo xgo && chown -R xgo:xgo /xgo
   USER xgo
   

2. Base image pinning: Consider pinning golang:1.24-bookworm to a specific digest for build reproducibility and supply chain security.

3. Validation needed: The ./all.bash script executes without integrity verification. Consider adding basic validation before execution.

[aofei]

/cc @cpunion

[cpunion]

@aofei Is there any log showing that a container was built using this configuration?

[aofei]

@aofei Is there any log showing that a container was built using this configuration?

There's no CI run for this yet. However, it can be verified locally by running:

$ go run github.com/goreleaser/goreleaser/v2@latest release --clean --snapshot --skip nfpm,snapcraft,winget
  • skipping announce, nfpm, publish, snapcraft, validate, and winget...
  • cleaning distribution directory
  • loading environment variables
  • getting and validating git state
    • git state                                      commit=86088d086c95f2ae1c411ef0488b09ab5c277285 branch=goreleaser-dockers_v2 current_tag=v1.2.0-pre.1 previous_tag=v1.1.3 dirty=false
    • pipe skipped or partially skipped              reason=disabled during snapshot mode
  • parsing tag
  • setting defaults
    • DEPRECATED: archives.format should not be used anymore, check https://goreleaser.com/deprecations#archivesformat for more info
    • DEPRECATED: archives.format_overrides.format should not be used anymore, check https://goreleaser.com/deprecations#archivesformat_overridesformat for more info
  • snapshotting
    • building snapshot...                           version=1.2.0-pre.1-SNAPSHOT-86088d08
  • running before hooks
    • running                                        hook=go mod download
  • ensuring distribution directory
  • setting up metadata
  • writing release metadata
  • loading go mod information
  • build prerequisites
  • building binaries
    • building                                       binary=.dist/xgo_windows_386_sse2/bin/xgo.exe
    • building                                       binary=.dist/xgo_linux_amd64_v1/bin/xgo
    • building                                       binary=.dist/xgo_linux_386_sse2/bin/xgo
    • building                                       binary=.dist/gop_windows_386_sse2/bin/gop.exe
    • building                                       binary=.dist/gop_windows_arm64_v8.0/bin/gop.exe
    • building                                       binary=.dist/gop_linux_amd64_v1/bin/gop
    • building                                       binary=.dist/xgo_darwin_amd64_v1/bin/xgo
    • building                                       binary=.dist/xgo_linux_arm64_v8.0/bin/xgo
    • building                                       binary=.dist/xgo_windows_arm64_v8.0/bin/xgo.exe
    • building                                       binary=.dist/gop_linux_386_sse2/bin/gop
    • building                                       binary=.dist/xgo_windows_amd64_v1/bin/xgo.exe
    • building                                       binary=.dist/gop_linux_arm64_v8.0/bin/gop
    • building                                       binary=.dist/gop_windows_amd64_v1/bin/gop.exe
    • building                                       binary=.dist/xgo_darwin_arm64_v8.0/bin/xgo
    • building                                       binary=.dist/gop_darwin_arm64_v8.0/bin/gop
    • building                                       binary=.dist/gop_darwin_amd64_v1/bin/gop
  • archives
    • archiving                                      name=.dist/fork.goplus.xgo1.2.0-pre.1-SNAPSHOT-86088d08.linux-arm64.tar.gz
    • archiving                                      name=.dist/fork.goplus.xgo1.2.0-pre.1-SNAPSHOT-86088d08.linux-amd64.tar.gz
    • archiving                                      name=.dist/fork.goplus.xgo1.2.0-pre.1-SNAPSHOT-86088d08.windows-arm64.zip
    • archiving                                      name=.dist/fork.goplus.xgo1.2.0-pre.1-SNAPSHOT-86088d08.darwin-amd64.tar.gz
    • archiving                                      name=.dist/fork.goplus.xgo1.2.0-pre.1-SNAPSHOT-86088d08.darwin-arm64.tar.gz
    • archiving                                      name=.dist/fork.goplus.xgo1.2.0-pre.1-SNAPSHOT-86088d08.windows-386.zip
    • archiving                                      name=.dist/fork.goplus.xgo1.2.0-pre.1-SNAPSHOT-86088d08.windows-amd64.zip
    • archiving                                      name=.dist/fork.goplus.xgo1.2.0-pre.1-SNAPSHOT-86088d08.linux-386.tar.gz
  • calculating checksums
  • docker images (v2)
    • dockers_v2 is experimental and subject to change
      details=
      │ Keep an eye on the release notes if you wish to rely on this for production builds.
      │ Please provide any feedback you might have at https://github.com/orgs/goreleaser/discussions/6005
    • invalid docker buildx driver
      details=
      │ docker buildx is using the docker driver, which isn't tested and may cause issues. Consider switching to the docker-container driver.
      │ Learn more at https://docs.docker.com/go/attestations/
      driver=docker
    • snapshot build: will not push any images
    • creating images
      images=
      │ xgo:1-arm64
      │ xgo:1.2-arm64
      │ xgo:1.2.0-pre.1-SNAPSHOT-86088d08-arm64
      │ xgo:latest-arm64
      id=xgo
    • creating images
      images=
      │ xgo:1-amd64
      │ xgo:1.2-amd64
      │ xgo:1.2.0-pre.1-SNAPSHOT-86088d08-amd64
      │ xgo:latest-amd64
      id=xgo
    • creating images
      images=
      │ xgo:1-386
      │ xgo:1.2-386
      │ xgo:1.2.0-pre.1-SNAPSHOT-86088d08-386
      │ xgo:latest-386
      id=xgo
    • created images
      images=
      │ xgo:1-arm64
      │ xgo:1.2-arm64
      │ xgo:1.2.0-pre.1-SNAPSHOT-86088d08-arm64
      │ xgo:latest-arm64
      id=xgo digest=sha256:fcd3c80030cdba43f2ba4cd26d7a1633ed4625ecae1aa18dde58942fd410e931
    • created images
      images=
      │ xgo:1-amd64
      │ xgo:1.2-amd64
      │ xgo:1.2.0-pre.1-SNAPSHOT-86088d08-amd64
      │ xgo:latest-amd64
      id=xgo digest=sha256:b06cc7c4bf9a7868edd67cdbd2aa0f98992439e83e011603e1e41b26837b8d42
    • created images
      images=
      │ xgo:1-386
      │ xgo:1.2-386
      │ xgo:1.2.0-pre.1-SNAPSHOT-86088d08-386
      │ xgo:latest-386
      id=xgo digest=sha256:dbb59c4e722a5baaab93255d137f1062261af0f991f44436ce198339d7e7903e
      • took: 2m14s
  • writing artifacts metadata
  • you are using deprecated options, check the output above for details
  • release succeeded after 2m20s
  • thanks for using GoReleaser!