🤖 ci: unify :main and release image builds via goreleaser (#87)

## Summary
Unify container publishing so `:main` and release images are both built
by GoReleaser, and enable multi-arch (`linux/amd64` + `linux/arm64`)
Docker output.

## Background
Previously, the CI `publish-main` job manually built an amd64 binary and
used `docker/build-push-action`, while release images were built via
GoReleaser. This duplicated image logic and left `:main` single-arch.

## Implementation
- Updated `.goreleaser.yaml`:
- Added `release.disable` gate for main-channel runs
(`GORELEASER_CHANNEL=main`) so CI can use `goreleaser release` without
creating a GitHub release.
  - Made Docker tags channel-aware:
    - main-channel: `main`
    - release-channel: `{{ .Version }}` and `latest`
  - Enabled Docker platforms:
    - `linux/amd64`
    - `linux/arm64`
  - Made OCI version label channel-aware.
- Updated `.github/workflows/ci.yaml` `publish-main` job:
  - Added `fetch-depth: 0` for git metadata availability.
- Replaced manual build + docker push steps with
`goreleaser/goreleaser-action`.
  - Added env for main-channel execution:
    - `GORELEASER_CURRENT_TAG=v0.0.0-main`
    - `GORELEASER_CHANNEL=main`
  - Included `.goreleaser.yaml` in publish path filtering.

## Validation
- `make verify-vendor`
- `make test`
- `make build`
- `make lint`
- `go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.10`
- `go run github.com/goreleaser/goreleaser/v2@v2.13.1 check`
- `GORELEASER_CHANNEL=main go run
github.com/goreleaser/goreleaser/v2@v2.13.1 check`
- `GORELEASER_CHANNEL=main GORELEASER_CURRENT_TAG=v0.0.0-main go run
github.com/goreleaser/goreleaser/v2@v2.13.1 release --clean
--skip=announce,publish,docker,validate`

## Risks
- Main-channel GoReleaser execution depends on the synthetic tag env
(`GORELEASER_CURRENT_TAG`). If altered/removed, the main publish job may
fail on untagged commits.
- Multi-arch image publishing now depends on Buildx/QEMU behavior
through GoReleaser integration in CI.

---

_Generated with `mux` • Model: `openai:gpt-5.3-codex` • Thinking:
`xhigh` • Cost: `$0.61`_

<!-- mux-attribution: model=openai:gpt-5.3-codex thinking=xhigh
costs=0.61 -->

Author: ThomasK33

.github/workflows/ci.yaml

@@ -68,6 +68,7 @@ jobs:
               - 'go.mod'
               - 'go.sum'
               - 'vendor/**'
+              - '.goreleaser.yaml'
               - 'Dockerfile*'
               - 'Dockerfile.goreleaser'
             terraform:
@@ -477,6 +478,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Go
@@ -485,16 +487,6 @@ jobs:
           go-version-file: go.mod
           cache: false
 
-      - name: Build linux/amd64 binary for image
-        env:
-          GOFLAGS: -mod=vendor
-          CGO_ENABLED: "0"
-          GOOS: linux
-          GOARCH: amd64
-        run: |
-          mkdir -p linux/amd64
-          go build -o linux/amd64/coder-k8s ./
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
@@ -505,29 +497,16 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Compute OCI label values
-        id: oci
-        run: echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-
-      - name: Build and push :main
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
+      - name: Run GoReleaser (:main)
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
-          context: .
-          file: Dockerfile.goreleaser
-          push: true
-          tags: ghcr.io/coder/coder-k8s:main
-          labels: |
-            org.opencontainers.image.created=${{ steps.oci.outputs.created }}
-            org.opencontainers.image.source=https://github.com/coder/coder-k8s
-            org.opencontainers.image.url=https://coder.github.io/coder-k8s/
-            org.opencontainers.image.documentation=https://coder.github.io/coder-k8s/
-            org.opencontainers.image.title=coder-k8s
-            org.opencontainers.image.description=Kubernetes operator for Coder
-            org.opencontainers.image.version=main
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.vendor=Coder
-            org.opencontainers.image.licenses=Apache-2.0
-            org.opencontainers.image.authors=Coder
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean --skip=announce
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GORELEASER_CURRENT_TAG: v0.0.0-main
+          GORELEASER_CHANNEL: main
 
       - name: Trivy image scan (:main)
         uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1

.goreleaser.yaml

@@ -26,8 +26,41 @@ archives:
       - LICENSE
       - README.md
 
+release:
+  disable: '{{ eq .Env.GORELEASER_CHANNEL "main" }}'
+
 dockers_v2:
-  - id: coder-k8s-image
+  - id: coder-k8s-image-main
+    disable: '{{ ne .Env.GORELEASER_CHANNEL "main" }}'
+    dockerfile: Dockerfile.goreleaser
+    ids:
+      - coder-k8s
+    images:
+      - ghcr.io/coder/coder-k8s
+    tags:
+      - main
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    sbom: true
+    labels:
+      org.opencontainers.image.created: "{{ .Date }}"
+      org.opencontainers.image.source: https://github.com/coder/coder-k8s
+      org.opencontainers.image.url: https://coder.github.io/coder-k8s/
+      org.opencontainers.image.documentation: https://coder.github.io/coder-k8s/
+      org.opencontainers.image.title: coder-k8s
+      org.opencontainers.image.description: Kubernetes operator for Coder
+      org.opencontainers.image.version: main
+      org.opencontainers.image.revision: "{{ .FullCommit }}"
+      org.opencontainers.image.vendor: Coder
+      org.opencontainers.image.licenses: Apache-2.0
+      org.opencontainers.image.authors: Coder
+    flags:
+      - "--pull=true"
+      - "--provenance=false"
+
+  - id: coder-k8s-image-release
+    disable: '{{ eq .Env.GORELEASER_CHANNEL "main" }}'
     dockerfile: Dockerfile.goreleaser
     ids:
       - coder-k8s
@@ -38,6 +71,7 @@ dockers_v2:
       - latest
     platforms:
       - linux/amd64
+      - linux/arm64
     sbom: true
     labels:
       org.opencontainers.image.created: "{{ .Date }}"