Add release workflow with reproducible builds

Adds .github/workflows/release.yml triggered on v* tags. Builds
linux/amd64 and linux/arm64 with -trimpath, CGO_ENABLED=0, and
SOURCE_DATE_EPOCH set from the tag commit — the three flags required
for Debian-compatible reproducible Go builds. Uploads binaries and a
sha256sums.txt to the GitHub Release via softprops/action-gh-release.

Wires a version variable in main.go (defaulting to "dev") that is
stamped at build time via -ldflags "-X main.version=<tag>". The
Makefile gains the same flags for local builds (VERSION ?= dev).

1 files changed, 7 insertions, 5 deletions

diff --git a/Makefile b/Makefile
index 438452c..9d9d33c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,7 @@
 GO = go
 SCDOC = scdoc
-LDFLAGS = "-s -w"
+VERSION ?= dev
+LDFLAGS = "-s -w -X main.version=$(VERSION)"
 
 pkgs = $(shell $(GO) list ./... | grep -v /vendor/)
 
@@ -19,13 +20,14 @@ shoelaces.8:
 docs: shoelaces.8
 
 test: fmt
-		$(GO) test -v $(pkgs) && \
-			./test/integ-test/integ_test.py -vv
+	$(GO) test -v $(pkgs) && \
+		./test/integ-test/integ_test.py -vv
 
 .PHONY: all clean docs
 
 binaries: linux windows
 linux:
-		GOOS=linux ${GO} build -o bin/shoelaces -ldflags ${LDFLAGS}
+	SOURCE_DATE_EPOCH=$(shell git log -1 --format=%ct) \
+	CGO_ENABLED=0 GOOS=linux ${GO} build -trimpath -o bin/shoelaces -ldflags ${LDFLAGS}
 windows:
-		GOOS=windows ${GO} build -o bin/shoelaces.exe -ldflags ${LDFLAGS}
+	CGO_ENABLED=0 GOOS=windows ${GO} build -trimpath -o bin/shoelaces.exe -ldflags ${LDFLAGS}