Release fixes

Author: lifeofguenter

.github/workflows/ci.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [main, master]
 
+# Minimal permissions — no secrets needed for CI
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -87,7 +87,7 @@ jobs:
         with:
           push: true
           context: .
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
@@ -108,17 +108,10 @@ jobs:
             goarch: amd64
           - goos: linux
             goarch: arm64
-          - goos: linux
-            goarch: arm
-            goarm: "7"
-          - goos: linux
-            goarch: "386"
           - goos: darwin
             goarch: amd64
           - goos: darwin
             goarch: arm64
-          - goos: freebsd
-            goarch: amd64
     steps:
       - uses: actions/checkout@v6
 
@@ -142,17 +135,17 @@ jobs:
           CGO_ENABLED: "0"
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
-          GOARM: ${{ matrix.goarm }}
         run: |
-          BINARY_NAME="wireguard-ui-${{ matrix.goos }}-${{ matrix.goarch }}"
-          if [ -n "${{ matrix.goarm }}" ]; then
-            BINARY_NAME="${BINARY_NAME}v${{ matrix.goarm }}"
-          fi
-          go build -ldflags="-X 'main.appVersion=${{ github.ref_name }}' -X 'main.buildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)' -X 'main.gitCommit=${{ github.sha }}'" \
-            -o "${BINARY_NAME}" .
-          tar czf "${BINARY_NAME}.tar.gz" "${BINARY_NAME}" init.sh
-
-      - name: Upload release asset
+          ARCHIVE="wireguard-ui-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz"
+          go build -trimpath \
+            -ldflags="-s -w -X 'main.appVersion=${{ github.ref_name }}' -X 'main.buildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)' -X 'main.gitCommit=${{ github.sha }}'" \
+            -o wireguard-ui .
+          tar czf "${ARCHIVE}" wireguard-ui
+          sha256sum "${ARCHIVE}" >> checksums.txt
+
+      - name: Upload release assets
         uses: softprops/action-gh-release@v3
         with:
-          files: wireguard-ui-*.tar.gz
+          files: |
+            wireguard-ui-*.tar.gz
+            checksums.txt

Dockerfile

@@ -32,8 +32,9 @@ COPY . .
 COPY --from=frontend /src/assets ./assets/
 
 RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
+    -trimpath \
     -ldflags="-s -w -X 'main.appVersion=${APP_VERSION}' -X 'main.buildTime=${BUILD_TIME}' -X 'main.gitCommit=${GIT_COMMIT}'" \
-    -a -o wg-ui .
+    -o wg-ui .
 
 # Stage 3: Runtime
 FROM alpine:3.23

Makefile

@@ -5,7 +5,7 @@ GO_PACKAGES := $(shell go list ./... | grep -v 'wireguard-ui$$' | grep -v node_m
 VERSION     ?= dev
 GIT_COMMIT  := $(shell git rev-parse --short HEAD 2>/dev/null || echo "N/A")
 BUILD_TIME  := $(shell date -u '+%Y-%m-%d %H:%M:%S')
-LDFLAGS     := -X 'main.appVersion=$(VERSION)' -X 'main.buildTime=$(BUILD_TIME)' -X 'main.gitCommit=$(GIT_COMMIT)'
+LDFLAGS     := -s -w -X 'main.appVersion=$(VERSION)' -X 'main.buildTime=$(BUILD_TIME)' -X 'main.gitCommit=$(GIT_COMMIT)'
 
 .PHONY: help build build-frontend build-backend test test-verbose coverage lint lint-go lint-frontend fmt vet clean dev
 
@@ -20,7 +20,7 @@ build-frontend: ## Build the React frontend
 	npm ci && npm run build
 
 build-backend: ## Build the Go binary
-	CGO_ENABLED=0 go build -ldflags="$(LDFLAGS)" -o $(APP_NAME) .
+	CGO_ENABLED=0 go build -trimpath -ldflags="$(LDFLAGS)" -o $(APP_NAME) .
 
 ## ---- Test ----