ci: build release binaries with goreleaser

Six targets, matching the cross-compile job: linux, darwin and windows on
amd64 and arm64. CGO_ENABLED=0 costs nothing — go-keyring shells out to
`security` on macOS and talks D-Bus on Linux, neither of which needs cgo.

The tag drives everything: release-please creates it and the release, then
`mode: append` uploads the archives into that release without touching the
notes it wrote.

beep boop

Author: khvn26

.github/workflows/release.yml

@@ -0,0 +1,28 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # upload release artifacts
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yaml

@@ -0,0 +1,43 @@
+version: 2
+
+builds:
+  - binary: flagsmith
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+    # .Tag, not .Version: `flagsmith --version` should print the tag verbatim,
+    # and internal/version.IsRelease expects the leading v.
+    ldflags:
+      - -s -w -X github.com/Flagsmith/flagsmith-cli/internal/version.Version={{ .Tag }}
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+
+archives:
+  - name_template: "flagsmith_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    formats:
+      - tar.gz
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    files:
+      - LICENSE
+      - README.md
+
+checksum:
+  name_template: checksums.txt
+
+# changelog handled by release-please.
+changelog:
+  disable: true
+
+release:
+  mode: append
+  prerelease: auto