ci(release): adopt central go-release.yml + add GoReleaser config

[nsportsman]

What

Converges julius onto the shared go-release.yml + local .goreleaser.yaml release model (the augustus/pius/nerva pattern). Two changes:

1. New .goreleaser.yaml — reproduces julius's current cross-compile (linux/darwin/windows, amd64+arm64; windows amd64 only), faithful -s -w ldflags. This is the local build manifest.
2. release.yml swapped to the byte-identical central caller — every merge to main auto-creates a clean vN.N.N semver tag (pushed as the version-bumper App to bypass the org tag ruleset) and builds via the config above.

Why

julius is imported as a Go module by guard-core (julius v1.2.0) — the goal is consistent, automatic semver tags for module consumers. Nothing references release-binary names, so the artifact-name change (julius-linux-amd64 raw → julius_<ver>_linux_amd64.tar.gz) is safe.

The old on: push: tags trigger is removed so the App-pushed tag doesn't double-fire a build.

Proof this works

Identical conversion just verified on nerva (PR #280): run green, App token minted, v1.4.1 tag + release created, go get nerva@v1.4.1 resolves.

Verify after merge

Run green · Generate app token success · new v1.2.1 tag + release via App · go get github.com/praetorian-inc/julius@v1.2.1 resolves.

Prereq

Secrets already set on the repo. julius is likely already in the version-bumper App install (nerva was); if the run's token step 404s, add julius at org settings → installations → 124346828.

🤖 Generated with Claude Code

[github-actions]

Gemini Review

No critical issues. The migration to a centralized GoReleaser workflow is well-configured and securely pins the reusable workflow to a specific commit hash.

Critical Issues

None.

Security

No security concerns flagged.

Suggestions

No suggestions.

---

Reviewed by Gemini (gemini-3.1-pro-preview)

[github-actions]

Claude Review

No critical issues — LGTM pending human review.

Critical issues

None.

Security

• External reusable workflow is pinned to a full SHA (f7fb4810…) — good supply-chain hygiene.
• Top-level permissions: contents: read with elevated perms scoped to the job is correct least-privilege.

Test coverage

N/A — CI/release config only, no production Go code changed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c2b2b795-ee95-46be-a828-2e1d71da9ffd

📥 Commits

Reviewing files that changed from the base of the PR and between 8801229 and ca041bd.

📒 Files selected for processing (1)

• .goreleaser.yaml

---

Walkthrough

The PR replaces the inline GitHub Actions release job with a call to an external reusable go-release workflow triggered on pushes to main (with job-level permissions and VERSION_BUMPER secrets forwarded). It also adds a .goreleaser.yaml that specifies the julius build matrix, static build flags, archive formats (tar.gz/zip), checksum and SBOM generation, Cosign signing of the checksum artifact, and changelog sorting/exclusion filters.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/adopt-go-release-autotag

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 880122912b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Configure or disable supply-chain outputs

On every main-branch release through the pinned reusable workflow, the defaults enable SBOM generation and checksum signing, but that workflow only installs Syft/cosign; GoReleaser emits those artifacts only when the local config contains sboms: and signs: entries. With only the checksum block here, releases will still publish archives and checksums but no SBOMs or cosign signatures, so the central workflow's supply-chain hardening is silently skipped; add the GoReleaser sboms/cosign signs config or pass the inputs as false explicitly.

Useful? React with 👍 / 👎.

[nsportsman]

Good catch — verified and fixed in ca041bd.

Confirmed valid: the central go-release.yml gates only the tool installs on enable-sbom/enable-sign (it runs plain goreleaser release --clean with no config injection and no separate sign/sbom step), so GoReleaser emits SBOMs/signatures only when the local config declares sboms:/signs:. Empirically confirmed: nerva v1.4.1 and augustus v0.0.10 shipped only archives + checksums.txt — no .sbom/.sig/.pem. (Provenance attestation does run — that's a separate GitHub-native step — so we had SLSA provenance but not SBOMs/signatures.)

Fix: added to .goreleaser.yaml:

sboms:
  - artifacts: archive          # Syft SBOM per archive
signs:
  - cmd: cosign                 # keyless OIDC signing of checksums.txt
    certificate: "${artifact}.pem"
    args: [sign-blob, --output-certificate=${certificate}, --output-signature=${signature}, ${artifact}, --yes]
    artifacts: checksum
    output: true

Validated with goreleaser check (v2.16.0). Prereqs already satisfied by the workflow: Syft + cosign installed, id-token: write granted; cosign v2 keyless needs no COSIGN_EXPERIMENTAL.

This will be backfilled to augustus/pius/nerva so the whole capability fleet emits SBOMs + cosign signatures consistently — verifying on this release first.