Fixing build to build binary

[fizikiukas]

Summary by CodeRabbit

• Chores
  • Updated CI/CD pipeline configuration for improved build and release processes.

[coderabbitai]

📝 Walkthrough

Walkthrough

The build-release workflow is updated to enable full git history during checkout and migrate from ncipollo/release-action to GoReleaser. The workflow now conditionally runs GoReleaser when a tag bump is detected, passing the new tag as an environment variable.

Changes

Release Workflow Migration to GoReleaser

Layer / File(s)	Summary
Git history configuration for release steps .github/workflows/build-release.yaml	The repository checkout is configured with fetch-depth: 0 to enable full git history access for subsequent release operations.
Go and GoReleaser integration .github/workflows/build-release.yaml	Adds Go 1.24.x environment setup and conditionally invokes goreleaser/goreleaser-action@v6 when the tag-bump step produces a new tag, passing the bumped tag via GORELEASER_CURRENT_TAG environment variable, and removes the prior ncipollo/release-action step.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• hostinger/api-cli#34: Both PRs modify .github/workflows/build-release.yaml and related release workflow configuration, directly updating the release pipeline setup.

Suggested reviewers

• zygintas

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'Fixing build to build binary' is vague and unclear. It uses redundant phrasing ('build to build') and lacks specificity about what build issue is being fixed or how GoReleaser integration and repository checkout improvements address it.	Use a more specific title such as 'Configure GoReleaser for binary builds' or 'Update CI workflow to use GoReleaser action' to clearly communicate the main change.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/build

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

.github/workflows/build-release.yaml (1)

15-18: 💤 Low value

Consider disabling credential persistence in checkout.

The checkout step does not set persist-credentials: false, which means GitHub token credentials will persist in the git configuration after checkout. This increases the attack surface if subsequent steps or artifacts are compromised.

🛡️ Proposed fix

 - name: Repo checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
+ persist-credentials: false

Note: This may require passing GITHUB_TOKEN explicitly to the tag-bump step if it needs push permissions. Verify that the workflow still functions correctly after this change.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-release.yaml around lines 15 - 18, Update the GitHub
Actions checkout step to disable credential persistence by adding
persist-credentials: false to the actions/checkout@v4 step (the "Repo checkout"
job step), then ensure any downstream steps that need to push (e.g., tag-bump)
are given an explicit GITHUB_TOKEN or appropriate token via with: or env: so
they retain push permissions after checkout credentials are disabled.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-release.yaml:
- Around line 32-41: Replace the movable tag for the GoReleaser action so it
uses the pinned commit SHA (change uses: goreleaser/goreleaser-action@v6 to
goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a) and keep
the same inputs/env; also verify the step with id "bump" (the
mathieudutour/github-tag-action@v6.2 invocation) actually exposes an output
named new_tag and either change steps.bump.outputs.new_tag to the correct output
key if different or modify the tag-action call to set/output new_tag accordingly
so GORELEASER_CURRENT_TAG receives the intended value.
- Around line 27-31: Update the workflow to use the newer actions/setup-go@v5
and replace mutable action tags with pinned commit SHAs for each action
referenced (actions/setup-go, actions/checkout, mathieudutour/github-tag-action,
goreleaser/goreleaser-action) so the release job uses immutable refs;
specifically change the actions/setup-go reference to the v5 commit SHA and pin
the other actions to their respective commit SHAs, and if you rely on
actions/setup-go caching, add or document cache-key safety/poisoning mitigations
for untrusted fork/PR runs.
---
Nitpick comments:
In @.github/workflows/build-release.yaml:
- Around line 15-18: Update the GitHub Actions checkout step to disable
credential persistence by adding persist-credentials: false to the
actions/checkout@v4 step (the "Repo checkout" job step), then ensure any
downstream steps that need to push (e.g., tag-bump) are given an explicit
GITHUB_TOKEN or appropriate token via with: or env: so they retain push
permissions after checkout credentials are disabled.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1e569acc-358d-44f7-ad92-6668527939fe

📥 Commits

Reviewing files that changed from the base of the PR and between 77eb4a9 and 525d5fe.

📒 Files selected for processing (1)

• .github/workflows/build-release.yaml