Repository navigation
release: add complete Linux packages and container images - #2814
Merged
cpunion merged 9 commits intoOct 15, 2026
Merged
Conversation
![fennoai[bot]](https://avatars.githubusercontent.com/in/1924301?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Review: Linux DEB/RPM packages and container image
This is a well-structured, correctness-first release/packaging change. The GoReleaser nfpms / dockers_v2 wiring is schema-correct, the multi-stage Dockerfile correctly uses dpkg-deb --extract so Go comes from the base image, version pins are consistent (1.27.0 across .go-version/goreleaser-cross/Dockerfile base), and the README additions were cross-checked claim-by-claim against the config and verified accurate (install paths, filenames, Go >= 1.20, LLVM 22, container tag/prerelease behavior, platforms). The smoke test (test-installed.sh) is thorough — it exercises cgo via C.abs, the goroutine/channel runtime, the symlink target, and the LLVM major version on fresh distro images.
No release-breaking defects or exploitable security issues were found. The inline comments below are minor hardening / maintainability suggestions, all reasonable to accept as-is with a short justifying comment.
A few additional non-inline observations:
- arm64 image build runs under QEMU emulation (
.goreleaser.yamldockers_v2.platforms: [linux/amd64, linux/arm64]built on the single amd64releaserunner). Thetest-linux-distributionsjob correctly uses native per-arch runners, but the published image build has no native-arm path. Acceptable; if arm64 publish time becomes a bottleneck, split across native runners and merge a manifest. - Supply-chain pinning (defense-in-depth):
GORELEASER_CROSS_IMAGE(release-build.yml:22) and thegolang:1.27.0-bookwormbase image are pinned by mutable tag rather than@sha256:digest. The goreleaser-cross image is the most-privileged pipeline input (it receivesGITHUB_TOKEN, the GHCR push credential, and the host Docker socket), so digest-pinning it would meaningfully strengthen the supply chain. This matches the repo's existing action-tag convention, so it's informational. - CI/token handling is correct:
contents: write+packages: writeis scoped only to the tag-gatedreleasejob (not global),GITHUB_TOKENis passed via quoted env, and the bash scripts (set -euo pipefail, single-quoteddocker run bash -cbody, validated/quoted positional args) have no injection paths.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
cpunion
force-pushed
the
codex/linux-container-release-20261014
branch
2 times, most recently
from
October 14, 2026 11:18
2a74b76 to
bb090ea
Compare
cpunion
force-pushed
the
codex/linux-container-release-20261014
branch
from
October 14, 2026 12:49
bb090ea to
374511b
Compare
LLGo WebAssembly build benchmarks
WebAssembly output sizes
LLGo WebAssembly build measurements
Compared with |
LLGo baseline benchmarks
Program measurements
Core language and compiler benchmarks
Timer runtime benchmarks
Compared with |
zhouguangyuan0718
approved these changes
Oct 15, 2026
zhouguangyuan0718
left a comment
zhouguangyuan0718
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed package layout and dependencies, multi-architecture image configuration, and release publishing conditions. No blocking issues found. Locally verified the published ARM64 DEB and RPM packages in clean Ubuntu 24.04 and Fedora 44 containers, including compilation as root and a regular user and package removal. Also verified anonymous GHCR image pulls and compilation as root and with Docker --user. The successful CI and fork release runs cover e6396d7; the current head differs only by README deletions, with packaging and release code unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enable complete Linux amd64/arm64 DEB/RPM packages and GHCR images.
major.minor,major, andlatesttags; prereleases get only their exact version.Configuration: set
FURY_TOKENto a Push token. OptionalFURY_ACCOUNTdefaults to the repository owner. GHCR usesGITHUB_TOKEN; enable public package visibility if needed for anonymous pulls.Validated with v0.999.1 on cpunion/llgo: all 20 release jobs passed. Release checksums, anonymous image pulls on both platforms, and anonymous downloads of all four Gemfury packages were verified.