feat(release): step 3, add GoReleaser build, packaging, and release workflows

[seantronsen]

Description

Moves building, packaging, and releasing onto GoReleaser, driven by each repo's .goreleaser.yaml, with sanity checks kept in Make.

• build-check-goreleaser: snapshot build of everything (binaries, archives, rpm/deb, images); publishes nothing, fork safe.
• build-release-goreleaser: mode chosen from the event. pull_request pushes pr-<N> images; v* tags publish semver images, packages (signed when gpg-key is passed), a draft release with generated notes, attestations, and the derived GPG public key.
• validate-packages: rpm/deb file list, signature, install test, report-only lint; gates publish-release.
• .goreleaser.example.yml: annotated reference config.
• Deprecates the workflows/actions these replace (GoReleaser/Docker build workflows, quadlet RPM build, GPG signing chain, signed-artifact release, quadlet validation). They warn at runtime and stay for pinned callers.

Important

Future PR: secure signing key procurement. Keys are currently passed as secrets by callers and only used on tag pushes; anyone with write access to a caller can still read them. Proper key handling is a separate PR.

Important

Future PR: deploy packages to remote distro repos. Packages are only attached to the GitHub release. Publishing to yum/apt repositories is a separate post-release workflow, out of scope for GoReleaser.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.

[seantronsen]

Since we're already going to v4, we should consider deleting the now deprecated old deployment methodology in favor of the new one.

[seantronsen]

@seantronsen , this needs to provide an example .goreleaser.yml file.

[seantronsen]

@seantronsen another todo: need to create another stacked PR for the actual deployment of these packages to the remote repo (e.g., yum/dnf/apt etc.).

[synackd]

@seantronsen You've requested my review, but I notice there are still outstanding items in the description and #41 (comment). Are those complete and do they need to be updated?

[seantronsen]

@seantronsen You've requested my review, but I notice there are still outstanding items in the description and #41 (comment). Are those complete and do they need to be updated?

It's ready. Two of the outstanding items are large enough to merit their own PRs. The third is just a note I need to delete.

[seantronsen]

force pushing to fix stack.