ci: fix artifact upload to draft release (#459)

Author: kb-newrelic

.github/workflows/ci-base.yaml

@@ -209,6 +209,18 @@ jobs:
             distributions/${{ inputs.distribution }}/dist
           key: ${{ steps.generate_binary_key.outputs.binary_key }}
 
+      - name: Force artifact version via git tag
+        run: |
+          version=$(./scripts/get-version.sh)
+          echo "Manifest version: $version"
+          
+          if git rev-parse "$version" >/dev/null 2>&1; then
+            echo "Tag $version already exists, skipping tag creation"
+          else
+            echo "Tagging locally with $version to force goreleaser to use correct version in artifact names"
+            git tag "$version"
+          fi
+
       - name: Build binaries & packages with GoReleaser
         if: inputs.publish || steps.cache-goreleaser.outputs.cache-hit != 'true'
         id: goreleaser

.github/workflows/release-draft.yaml

@@ -174,15 +174,34 @@ jobs:
           if [ ! -f "artifacts/dist/artifacts.json" ]; then
             echo "❌ artifacts.json not found"
             exit 1
+          else
+            jq '.' artifacts/dist/artifacts.json
           fi
 
           echo "📦 Uploading artifacts for ${{ matrix.distribution }}${{ matrix.fips && ' (FIPS)' || '' }}"
 
+          release_tag="${{ needs.draft-release.outputs.release-tag }}"
+
           # Read artifacts.json and upload each file with a path
           jq -r '.[] | select(has("path")) | .path' artifacts/dist/artifacts.json | while IFS= read -r artifact_path; do
+            # Skip unrelated build artifacts
+            if [[ ! "$artifact_path" =~ \.(gz|asc|sum|deb|rpm|zip)$ ]]; then
+              echo "⏭️  Skipping: $artifact_path"
+              continue
+            fi
+            
+            # Extract filename from path
+            artifact_filename=$(basename "$artifact_path")
+            
+            # Validate that filename contains the release tag
+            if [[ ! "$artifact_filename" =~ $release_tag ]]; then
+              echo "❌ Artifact filename does not contain release tag '$release_tag': $artifact_filename"
+              exit 1
+            fi
+            
             if [ -f "artifacts/$artifact_path" ]; then
               echo "⬆️  Uploading: $artifact_path"
-              gh release upload ${{ needs.draft-release.outputs.release-tag }} \
+              gh release upload "$release_tag" \
                 "artifacts/$artifact_path" \
                 --clobber
             else

.goreleaser.yaml

@@ -11,18 +11,14 @@ release:
     ### Draft Checklist
     - [ ] Tests from last nightly build have passed and are stable.
     - [ ] Release notes below have been reviewed and edited as needed.
-    - [ ] Binaries from each distro have been built and are attached to the release.
-      - [ ] nrdot-collector-host
-      - [ ] nrdot-collector-k8s
+    - [ ] Binaries/Archives/Packages.
+      - [ ] Artifacts for each distro have been attached to the draft release
+      - [ ] Any new artifact type is attached to the draft release (we filter on upload for expected file types)
     - [ ] Docker images for each distro have been published to ECR
-      - [ ] nrdot-collector-host image published and tagged
-      - [ ] nrdot-collector-k8s image published and tagged
     ### Publish Checklist
     - [ ] Checklist has been reviewed and all items are complete.
     - [ ] Draft header has been removed.
     - [ ] Docker images for each distro have been published to docker hub and tagged as latest
-      - [ ] [nrdot-collector-host](https://hub.docker.com/repository/docker/newrelic/nrdot-collector-host/tags) version {{ .Version }} tagged as latest
-      - [ ] [nrdot-collector-k8s](https://hub.docker.com/repository/docker/newrelic/nrdot-collector-k8s/tags) version {{ .Version }} tagged as latest
     - [ ] Slack notifications have been sent to appropriate channels
     - [ ] PR has been generated to update docs in [docs.newrelic.com](https://github.com/newrelic/docs-website/pulls)
     ###### !!! REMOVE THIS HEADER BEFORE PUBLISHING !!!

cmd/goreleaser/internal/configure.go

@@ -34,14 +34,17 @@ const (
 )
 
 type Distribution struct {
-	BaseName      string
-	FullName      string // dist or dist-fips
-	Fips          bool
-	Goos          []string
-	IgnoredBuilds []config.IgnoredBuild
-	IncludeConfig bool
-	SkipBinaries  bool
-	SkipArchives  bool
+	BaseName                string
+	FullName                string // dist or dist-fips
+	Fips                    bool
+	Goos                    []string
+	IgnoredBuilds           []config.IgnoredBuild
+	IncludeConfig           bool
+	SkipPackages            bool
+	SkipArchives            bool
+	SkipUploadToBlobStorage bool
+	SkipChecksums           bool
+	SkipSigning             bool
 }
 
 var (
@@ -55,18 +58,14 @@ func Generate(distFlag string, fips bool) config.Project {
 	dist := NewDistribution(distFlag, fips)
 
 	return config.Project{
-		ProjectName: projectName,
-		Checksum: config.Checksum{
-			NameTemplate: "{{ .ArtifactName }}.sum",
-			Split:        true,
-			Algorithm:    "sha256",
-		},
+		ProjectName:     projectName,
+		Checksum:        Checksum(dist),
 		Builds:          Builds(dist),
 		Archives:        Archives(dist),
 		NFPMs:           Packages(dist),
 		Dockers:         DockerImages(dist),
 		DockerManifests: DockerManifests(dist),
-		Signs:           Sign(),
+		Signs:           Signs(dist),
 		Version:         2,
 		Changelog:       config.Changelog{Disable: "true"},
 		Snapshot: config.Snapshot{
@@ -97,34 +96,48 @@ func NewDistribution(baseDist string, fips bool) Distribution {
 		IgnoredBuilds: []config.IgnoredBuild{
 			{Goos: "windows", Goarch: "arm64"},
 		},
-		IncludeConfig: true,
-		SkipBinaries:  false,
-		SkipArchives:  false,
+		IncludeConfig:           true,
+		SkipUploadToBlobStorage: false,
+		SkipPackages:            false,
+		SkipArchives:            false,
+		SkipSigning:             false,
+		SkipChecksums:           false,
 	}
 
-	if baseDist == K8sDistro {
+	if isNoConfigDistro(baseDist) {
 		dist.IncludeConfig = false
 	}
 
-	if baseDist == K8sDistro || fips {
+	if isImageOnlyDistro(baseDist, fips) {
 		dist.Goos = []string{"linux"}
 		dist.IgnoredBuilds = nil
-		dist.SkipBinaries = true
+		dist.SkipPackages = true
 		dist.SkipArchives = true
+		dist.SkipUploadToBlobStorage = true
+		dist.SkipSigning = true
+		dist.SkipChecksums = true
 	}
 
 	if baseDist == ExperimentalDistro {
 		dist.Goos = []string{"linux"}
 		dist.IgnoredBuilds = nil
-		dist.IncludeConfig = false
-		dist.SkipBinaries = true
+		dist.SkipPackages = true
+		dist.SkipUploadToBlobStorage = true
 	}
 
 	return dist
 }
 
+func isNoConfigDistro(dist string) bool {
+	return dist == K8sDistro || dist == ExperimentalDistro
+}
+
+func isImageOnlyDistro(dist string, fips bool) bool {
+	return dist == K8sDistro || fips
+}
+
 func Blobs(dist Distribution) []config.Blob {
-	if dist.SkipBinaries {
+	if dist.SkipUploadToBlobStorage {
 		return nil
 	}
 
@@ -209,7 +222,12 @@ func Build(dist Distribution) config.Build {
 
 func Archives(dist Distribution) []config.Archive {
 	if dist.SkipArchives {
-		return nil
+		// https://goreleaser.com/customization/archive/#do-not-archive
+		return []config.Archive{
+			{
+				Formats: []string{"binary"},
+			},
+		}
 	}
 
 	return []config.Archive{
@@ -243,7 +261,7 @@ func Archive(dist Distribution) config.Archive {
 }
 
 func Packages(dist Distribution) []config.NFPM {
-	if dist.SkipBinaries {
+	if dist.SkipPackages {
 		return nil
 	}
 
@@ -411,21 +429,42 @@ func DockerManifest(version string, dist Distribution) config.DockerManifest {
 	}
 }
 
-func Sign() []config.Sign {
+func Checksum(dist Distribution) config.Checksum {
+	if dist.SkipChecksums {
+		return config.Checksum{
+			Disable: true,
+		}
+	}
+	return config.Checksum{
+		NameTemplate: "{{ .ArtifactName }}.sum",
+		Split:        true,
+		Algorithm:    "sha256",
+	}
+}
+
+func Signs(dist Distribution) []config.Sign {
+	if dist.SkipSigning {
+		return nil
+	}
+
 	return []config.Sign{
-		{
-			Artifacts: "all",
-			Signature: "${artifact}.asc",
-			Args: []string{
-				"--batch",
-				"-u",
-				"{{ .Env.GPG_FINGERPRINT }}",
-				"--output",
-				"${signature}",
-				"--detach-sign",
-				"--armor",
-				"${artifact}",
-			},
+		SignAllArtifacts(),
+	}
+}
+
+func SignAllArtifacts() config.Sign {
+	return config.Sign{
+		Artifacts: "all",
+		Signature: "${artifact}.asc",
+		Args: []string{
+			"--batch",
+			"-u",
+			"{{ .Env.GPG_FINGERPRINT }}",
+			"--output",
+			"${signature}",
+			"--detach-sign",
+			"--armor",
+			"${artifact}",
 		},
 	}
 }

distributions/nrdot-collector-experimental/.goreleaser-fips.yaml

@@ -35,12 +35,13 @@ builds:
         env:
           - CC=aarch64-linux-gnu-gcc
           - CXX=aarch64-linux-gnu-g++
+archives:
+  - formats:
+      - binary
 snapshot:
   version_template: '{{ incpatch .Version }}-SNAPSHOT-{{.ShortCommit}}'
 checksum:
-  name_template: '{{ .ArtifactName }}.sum'
-  algorithm: sha256
-  split: true
+  disable: true
 dockers:
   - goos: linux
     goarch: amd64
@@ -81,15 +82,3 @@ docker_manifests:
       - '{{ .Env.REGISTRY }}/nrdot-collector-experimental:{{ .Version }}-fips-arm64'
 changelog:
   disable: "true"
-signs:
-  - args:
-      - --batch
-      - -u
-      - '{{ .Env.GPG_FINGERPRINT }}'
-      - --output
-      - ${signature}
-      - --detach-sign
-      - --armor
-      - ${artifact}
-    signature: ${artifact}.asc
-    artifacts: all

distributions/nrdot-collector-host/.goreleaser-fips.yaml

@@ -35,12 +35,13 @@ builds:
         env:
           - CC=aarch64-linux-gnu-gcc
           - CXX=aarch64-linux-gnu-g++
+archives:
+  - formats:
+      - binary
 snapshot:
   version_template: '{{ incpatch .Version }}-SNAPSHOT-{{.ShortCommit}}'
 checksum:
-  name_template: '{{ .ArtifactName }}.sum'
-  algorithm: sha256
-  split: true
+  disable: true
 dockers:
   - goos: linux
     goarch: amd64
@@ -85,15 +86,3 @@ docker_manifests:
       - '{{ .Env.REGISTRY }}/nrdot-collector-host:{{ .Version }}-fips-arm64'
 changelog:
   disable: "true"
-signs:
-  - args:
-      - --batch
-      - -u
-      - '{{ .Env.GPG_FINGERPRINT }}'
-      - --output
-      - ${signature}
-      - --detach-sign
-      - --armor
-      - ${artifact}
-    signature: ${artifact}.asc
-    artifacts: all

distributions/nrdot-collector-k8s/.goreleaser-fips.yaml

@@ -35,12 +35,13 @@ builds:
         env:
           - CC=aarch64-linux-gnu-gcc
           - CXX=aarch64-linux-gnu-g++
+archives:
+  - formats:
+      - binary
 snapshot:
   version_template: '{{ incpatch .Version }}-SNAPSHOT-{{.ShortCommit}}'
 checksum:
-  name_template: '{{ .ArtifactName }}.sum'
-  algorithm: sha256
-  split: true
+  disable: true
 dockers:
   - goos: linux
     goarch: amd64
@@ -81,15 +82,3 @@ docker_manifests:
       - '{{ .Env.REGISTRY }}/nrdot-collector-k8s:{{ .Version }}-fips-arm64'
 changelog:
   disable: "true"
-signs:
-  - args:
-      - --batch
-      - -u
-      - '{{ .Env.GPG_FINGERPRINT }}'
-      - --output
-      - ${signature}
-      - --detach-sign
-      - --armor
-      - ${artifact}
-    signature: ${artifact}.asc
-    artifacts: all

distributions/nrdot-collector-k8s/.goreleaser.yaml

@@ -21,12 +21,13 @@ builds:
     env:
       - CGO_ENABLED=0
       - GOEXPERIMENT=
+archives:
+  - formats:
+      - binary
 snapshot:
   version_template: '{{ incpatch .Version }}-SNAPSHOT-{{.ShortCommit}}'
 checksum:
-  name_template: '{{ .ArtifactName }}.sum'
-  algorithm: sha256
-  split: true
+  disable: true
 dockers:
   - goos: linux
     goarch: amd64
@@ -73,15 +74,3 @@ docker_manifests:
       - '{{ .Env.REGISTRY }}/nrdot-collector-k8s:latest-arm64'
 changelog:
   disable: "true"
-signs:
-  - args:
-      - --batch
-      - -u
-      - '{{ .Env.GPG_FINGERPRINT }}'
-      - --output
-      - ${signature}
-      - --detach-sign
-      - --armor
-      - ${artifact}
-    signature: ${artifact}.asc
-    artifacts: all