Release builds broken: CGO=0 linux target fails via cli-common/onepassword SDK

[rianjs]

Summary

google-readonly release builds are failing in GoReleaser on the static Linux target.

Recent red runs:

• v1.0.56 Release, 2026-05-28: https://github.com/open-cli-collective/google-readonly/actions/runs/26574627112
• v1.0.55 Release, 2026-05-28: https://github.com/open-cli-collective/google-readonly/actions/runs/26546506927
• v1.0.53 Release, 2026-05-26: https://github.com/open-cli-collective/google-readonly/actions/runs/26481742068

The v1.0.56 failed job is goreleaser; packaging jobs were skipped because the build never produced artifacts.

Failure signature

The failing sub-build is linux_amd64_v1 from the gro-unix-win build (CGO_ENABLED=0).

Log excerpt from the latest failed run:

build failed: exit status 1: # github.com/1password/onepassword-sdk-go
.../onepassword-sdk-go@v0.4.1-beta.1/client_builder_no_cgo.go:7:10: undefined: ERROR_WithDesktopAppIntegration_requires_CGO_To_Cross_Compile_See_README_CGO_Section
target=linux_amd64_v1

Local repro:

CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build ./cmd/gro

Root cause

This is the same family-wide cli-common/credstore break tracked in:

• Root issue: credstore: CGO=0 linux builds fail via byteness/keyring 1Password SDK cli-common#40
• Original observed CLI issue: Release builds broken: CGO=0 linux/windows fails to compile (onepassword-sdk-go via byteness/keyring) slack-chat-api#177
• Full audit comment: Release builds broken: CGO=0 linux/windows fails to compile (onepassword-sdk-go via byteness/keyring) slack-chat-api#177 (comment)

Dependency chain:

google-readonly -> cli-common v0.2.1 -> byteness/keyring v1.9.3 -> onepassword-sdk-go v0.4.1-beta.1

Acceptance

• Static Linux release sub-builds pass for gro with CGO_ENABLED=0.
• goreleaser release --snapshot --clean reaches archive/package generation instead of failing on linux_amd64_v1.
• The eventual fix comes from the cli-common/byteness/keyring root fix, not a per-repo Linux CGO workaround.

[rianjs]

Fixed by merged PR #150, which bumps cli-common to v0.2.2 and adds static release build guards.