ci: publish official release binaries

.github/workflows/release-binaries.yml

@@ -0,0 +1,83 @@
+# Build the official ndt-server binaries and attach them to GitHub Releases.
+#
+# Publishing a release builds ndt-server and its schema generator
+# (cmd/generate-schemas, a nested module) for linux/amd64 and uploads them to
+# that release, together with a checksums.txt:
+#
+#   ndt-server_<tag>_linux_amd64
+#   generate-schemas_<tag>_linux_amd64
+#   checksums.txt
+#
+# The binaries are pure Go, statically linked (CGO_ENABLED=0), and stripped
+# (-s -w); like the container image, ndt-server is stamped with
+# version.Version and prometheusx.GitShortCommit. Releases before the cgo
+# removal (#436) do not build with CGO_ENABLED=0.
+#
+# To attach the binaries to an existing release, dispatch the workflow with
+# that release's tag; the workflow from the default branch then builds the
+# tagged sources:
+#
+#   gh workflow run release-binaries.yml -f tag=<tag>
+name: release-binaries
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Tag of an existing release to build and upload binaries for
+        required: true
+        type: string
+  pull_request:
+
+jobs:
+  release-binaries:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    env:
+      # Empty on pull requests: the build then stamps `git describe` output
+      # and nothing is uploaded.
+      TAG: ${{ inputs.tag || github.event.release.tag_name }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.tag || github.event.release.tag_name || github.sha }}
+
+      - uses: actions/setup-go@v7
+        with:
+          go-version: stable
+
+      # go version -m omits -ldflags under -trimpath, so the check looks for
+      # the version stamp in the binary itself.
+      - name: Build
+        run: |
+          version="${TAG:-$(git describe --tags --always)}"
+          bin="dist/ndt-server_${version}_linux_amd64"
+          ldflags="-s -w"
+          ldflags+=" -X github.com/m-lab/ndt-server/version.Version=${version}"
+          ldflags+=" -X github.com/m-lab/go/prometheusx.GitShortCommit=$(git log -1 --format=%h)"
+          CGO_ENABLED=0 go build -trimpath -ldflags "${ldflags}" -o "${bin}" .
+          grep -qaF -- "${version}" "${bin}" ||
+            { echo "ERROR: ${bin} lacks the ${version} version stamp" >&2; exit 1; }
+
+          # A nested module: build it from its own directory.
+          (cd cmd/generate-schemas && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" \
+            -o "../../dist/generate-schemas_${version}_linux_amd64" .)
+
+          for bin in dist/*; do
+            file -L "${bin}" | grep "statically linked" ||
+              { echo "ERROR: ${bin} is not statically linked" >&2; exit 1; }
+            go version -m "${bin}"
+          done
+
+      - name: Upload to the release
+        if: github.event_name != 'pull_request'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          cd dist
+          sha256sum *_linux_amd64 > checksums.txt
+          cat checksums.txt
+          gh release upload "${TAG}" *_linux_amd64 checksums.txt --clobber --repo "${GITHUB_REPOSITORY}"