Add Goreleaser action

.github/workflows/release.yaml

@@ -0,0 +1,36 @@
+---
+name: goreleaser
+
+on:
+  push:
+    # run only against tags
+    tags:
+      - "*"
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: stable
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          KO_DOCKER_REPO: ghcr.io/${{ github.repository }}

.gitignore

@@ -25,3 +25,5 @@ go.work
 *.swp
 *.swo
 *~
+
+dist/

.goreleaser.yaml

@@ -0,0 +1,75 @@
+---
+version: 2
+
+before:
+  hooks:
+    - go mod tidy
+    - go generate ./...
+    # - go fmt ./...
+    # - go vet ./...
+    # - go test ./...
+
+builds:
+  - env:
+      - CGO_ENABLED=0
+    main: ./cmd
+    binary: istio-fortsa
+    flags:
+      - -trimpath
+    ldflags:
+      - -s -w -X main.Version={{ .Version }} -X main.Commit={{ .Commit }} -X main.CommitDate={{ .CommitDate }}
+    goos:
+      - linux
+    goarch:
+      - amd64
+
+kos:
+  - base_image: gcr.io/distroless/static:nonroot
+    repository: ghcr.io/{{ .Env.GITHUB_REPOSITORY }}
+    tags:
+      - "{{ .Tag }}"
+      - latest
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+    ldflags:
+      - -s
+      - -w
+      - -extldflags "-static"
+      - -X main.Version={{ .Version }}
+      - -X main.Commit={{ .Commit }}
+      - -X main.CommitDate={{ .CommitDate }}
+    bare: true
+    preserve_import_paths: false
+    base_import_paths: false
+    labels:
+      org.opencontainers.image.title: "{{ .ProjectName }}"
+      org.opencontainers.image.description: "{{ .ProjectName }}"
+      org.opencontainers.image.revision: "{{ .FullCommit }}"
+      org.opencontainers.image.version: "{{ .Version }}"
+      org.opencontainers.image.url: "{{ .Env.GITHUB_SERVER_URL }}/{{ .Env.GITHUB_REPOSITORY }}"
+      org.opencontainers.image.source: "{{ .Env.GITHUB_SERVER_URL }}/{{ .Env.GITHUB_REPOSITORY }}"
+
+
+release:
+  skip_upload: true
+  footer: |
+    # Container images
+
+    ```
+    ghcr.io/{{ .Env.GITHUB_REPOSITORY }}:{{ .Tag }}
+    ```
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs"
+      - "^test"
+      - "^chore"
+      - "Merge pull request"
+      - "Merge branch"

.ko.yaml

@@ -0,0 +1,20 @@
+---
+defaultBaseImage: gcr.io/distroless/static:nonroot
+
+defaultPlatforms:
+  - linux/amd64
+  - linux/arm64
+
+defaultEnv:
+  - CGO_ENABLED=0
+
+defaultLdflags:
+  - -s
+  - -w
+  - -extldflags "-static"
+  - -X main.Version={{ .Git.Tag }}
+  - -X main.Commit={{ .Git.FullCommit }}
+  - -X main.CommitDate={{ .Git.CommitDate }}
+
+builds:
+  main: ./cmd

cmd/main.go

@@ -20,6 +20,7 @@ import (
 	"context"
 	"crypto/tls"
 	"flag"
+	"fmt"
 	"os"
 
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
@@ -42,6 +43,10 @@ import (
 )
 
 var (
+	Version    = "" // set at compile time with -ldflags "-X main.Version=x.y.yz"
+	Commit     = "" // set at compile time with -ldflags "-X main.Commit=..."
+	CommitDate = "" // set at compile time with -ldflags "-X main.CommitDate=..."
+
 	scheme    = runtime.NewScheme()
 	setupLog  = ctrl.Log.WithName("setup")
 	istioData = istiodata.IstioData{}
@@ -59,6 +64,7 @@ func main() {
 	var probeAddr string
 	var secureMetrics bool
 	var enableHTTP2 bool
+	var version bool
 	flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
 	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
 	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
@@ -68,12 +74,18 @@ func main() {
 		"If set the metrics endpoint is served securely")
 	flag.BoolVar(&enableHTTP2, "enable-http2", false,
 		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
+	flag.BoolVar(&version, "version", false, "Print the version of the tool")
 	opts := zap.Options{
 		Development: true,
 	}
 	opts.BindFlags(flag.CommandLine)
 	flag.Parse()
 
+	if version {
+		fmt.Printf("%s (%s %s)\n", Version, Commit, CommitDate)
+		os.Exit(1)
+	}
+
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
 
 	// if the enable-http2 flag is false (the default), http/2 should be disabled