build: switch ko image build to goreleaser with manifest signing

.github/workflows/release.yaml

@@ -9,18 +9,33 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
           go-version: stable
           check-latest: true
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:
@@ -29,3 +44,9 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
+
+      - name: Build and Push Helm Chart
+        run: |
+          VERSION=${GITHUB_REF#refs/tags/v}
+          helm package deploy/charts/platform-health --destination _build --version "$VERSION" --app-version "$VERSION"
+          helm push _build/platform-health-*.tgz oci://ghcr.io/isometry/charts

.goreleaser.yml

@@ -1,16 +1,18 @@
 version: 2
+
 before:
   hooks:
     - go generate ./...
     - go mod tidy
+
 builds:
   - &standardBuild
     id: client
     main: ./cmd/phc
     binary: phc
     env:
       - CGO_ENABLED=0
-    mod_timestamp: "{{ .CommitTimestamp }}"
+    mod_timestamp: "{{.CommitTimestamp}}"
     flags:
       - -trimpath
     ldflags:
@@ -27,22 +29,28 @@ builds:
     id: server
     main: ./cmd/phs
     binary: phs
+
 archives:
   - format: zip
-    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    name_template: "{{.ProjectName}}_{{.Version}}_{{.Os}}_{{.Arch}}"
+
 snapshot:
-  name_template: "{{ .Tag }}-next"
+  name_template: "{{.Tag}}-next"
+
 checksum:
-  name_template: "{{ .ProjectName }}_{{ .Version }}_SHA256SUMS"
+  name_template: "{{.ProjectName}}_{{.Version}}_SHA256SUMS"
   algorithm: sha256
+
 release:
   draft: false
+
 changelog:
   sort: asc
   filters:
     exclude:
       - "^docs:"
       - "^test:"
+
 brews:
   - repository:
       owner: isometry
@@ -54,3 +62,34 @@ brews:
     install: |
       bin.install "phc"
       bin.install "phs"
+
+kos:
+  - id: server
+    repository: ghcr.io/isometry/platform-health
+    main: ./cmd/phs
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+    ldflags:
+      - -s -w
+    ko_data_creation_time: "{{.CommitTimestamp}}"
+    labels:
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.name: "{{.ProjectName}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Version}}"
+      org.opencontainers.image.source: "{{.GitURL}}"
+    bare: true
+    preserve_import_paths: false
+    tags:
+      - "{{.Version}}"
+      - latest
+
+docker_signs:
+  - id: server
+    args: ["sign", "--yes", "${artifact}"]
+    artifacts: manifests