From 71471b41b5ec4aa520c07d7b963bc0746624dfc4 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 15 Sep 2026 10:15:56 -0600 Subject: [PATCH 1/4] fix: add conditional to the goreleaser output processor Signed-off-by: Sean Tronsen --- .../workflows/build-publish-container-goreleaser.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-publish-container-goreleaser.yml b/.github/workflows/build-publish-container-goreleaser.yml index e2dc679..70372fa 100644 --- a/.github/workflows/build-publish-container-goreleaser.yml +++ b/.github/workflows/build-publish-container-goreleaser.yml @@ -114,9 +114,16 @@ jobs: const artifacts = ${{ steps.goreleaser.outputs.artifacts }}; const firstNonNullDigest = artifacts.find(artifact => artifact.extra && artifact.extra.Digest != null)?.extra.Digest; console.log(firstNonNullDigest); - fs.writeFileSync('digest.txt', firstNonNullDigest); + if (firstNonNullDigest) { + fs.writeFileSync('digest.txt', firstNonNullDigest); + } else { + console.error('No digest found in artifacts'); + process.exit(1); + } EOF - echo "digest=$(cat digest.txt)" >> "${GITHUB_OUTPUT}" + if [ -f digest.txt ]; then + echo "digest=$(cat digest.txt)" >> "${GITHUB_OUTPUT}" + fi - name: Attest Binaries if: ${{ (env.SKIP_CONTAINER_PUBLISH == 'false') && (inputs.is_pr_build == false) }} uses: actions/attest-build-provenance@v4.1.0 From c10e9a679e7794b71526d79422885b9ec92c8503 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 15 Sep 2026 10:25:32 -0600 Subject: [PATCH 2/4] feat: add support for installing additional build dependencies Signed-off-by: Sean Tronsen --- .../workflows/build-publish-container-goreleaser.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/build-publish-container-goreleaser.yml b/.github/workflows/build-publish-container-goreleaser.yml index 70372fa..a94c761 100644 --- a/.github/workflows/build-publish-container-goreleaser.yml +++ b/.github/workflows/build-publish-container-goreleaser.yml @@ -9,6 +9,10 @@ name: Build and publish container using goreleaser on: workflow_call: inputs: + build_deps: + type: string + required: false + description: 'Space-separated list of apt packages to install before building (e.g. "gcc-aarch64-linux-gnu libc6-dev-arm64-cross").' cgo_enabled: type: number required: false @@ -41,6 +45,14 @@ jobs: container_build_publish: runs-on: ubuntu-latest steps: + - name: Install build dependencies + if: ${{ inputs.build_deps != '' }} + env: + BUILD_DEPS: ${{ inputs.build_deps }} + run: | + sudo apt update + # shellcheck disable=SC2086 # intentional word splitting + sudo apt install -y --no-install-recommends ${BUILD_DEPS} - name: Set up Go uses: actions/setup-go@v6.4.0 with: From 810c179322618ac004acb9d7d0a9a8cc0e408905 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 15 Sep 2026 10:26:04 -0600 Subject: [PATCH 3/4] feat: add support for release notes for release builds Signed-off-by: Sean Tronsen --- .github/workflows/build-publish-container-goreleaser.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-publish-container-goreleaser.yml b/.github/workflows/build-publish-container-goreleaser.yml index a94c761..f518063 100644 --- a/.github/workflows/build-publish-container-goreleaser.yml +++ b/.github/workflows/build-publish-container-goreleaser.yml @@ -109,13 +109,18 @@ jobs: git config --global user.name "github-actions[bot]" git config --global user.email "github-actions[bot]@users.noreply.github.com" git tag -f -a pr-${{ inputs.pr_number }} -m "PR Release" + - name: Generate release notes + if: ${{ !inputs.is_pr_build }} + env: + GITHUB_TOKEN: ${{ github.token }} + run: gh api "repos/${GITHUB_REPOSITORY}/releases/generate-notes" -F tag_name="${{ github.ref_name }}" --jq .body > ../notes.md - name: Build/Push/Release container with goreleaser uses: goreleaser/goreleaser-action@v6 env: GITHUB_TOKEN: ${{ github.token }} with: version: '~> 2' - args: release --clean ${{ inputs.is_pr_build && '--skip=announce,validate,archive' || '' }}${{ env.SKIP_CONTAINER_PUBLISH == 'true' && (inputs.is_pr_build && ',publish' || '--skip=publish') || '' }}${{ inputs.release_draft && ' --draft' || '' }} + args: release --clean ${{ inputs.is_pr_build && '--skip=announce,validate,archive' || '' }}${{ env.SKIP_CONTAINER_PUBLISH == 'true' && (inputs.is_pr_build && ',publish' || '--skip=publish') || '' }} ${{ inputs.release_draft && '--draft' || '' }} ${{ !inputs.is_pr_build && '--release-notes ../notes.md' || '' }} id: goreleaser - name: Process goreleaser output if: env.SKIP_CONTAINER_PUBLISH == 'false' From 916586b45bcce7092dff1f99ca060247b9e50824 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 15 Sep 2026 10:30:20 -0600 Subject: [PATCH 4/4] docs: describe new build workflow parameters and behaviors Signed-off-by: Sean Tronsen --- README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 8ace4ea..9e91d68 100644 --- a/README.md +++ b/README.md @@ -156,7 +156,9 @@ jobs: ``` ### build-publish-container-goreleaser (Reusable Workflow) -Builds and publishes a container image via GoReleaser, with multi-arch builds, build provenance attestation, and PR snapshot support. +Builds and publishes a container image via GoReleaser, with multi-arch builds, build provenance attestation, and PR snapshot support. Release builds (`is_pr_build: false`) pass GitHub's auto-generated release notes for the pushed tag to GoReleaser via `--release-notes`. + +Optional `build_deps` is a space-separated list of apt packages installed before the build, for cases such as CGO cross-compilation that need a toolchain not present on the runner. **Usage:** ```yaml @@ -166,6 +168,8 @@ jobs: with: registry_subject_name: ghcr.io/openchami/foo release_draft: false + cgo_enabled: 1 + build_deps: gcc-aarch64-linux-gnu libc6-dev-arm64-cross ``` ### build-rpm-quadlet (Reusable Workflow)