Skip to content

goreleaser

goreleaser release --clean on release tags. Attaches binaries to the Release that an upstream release-MR tool (e.g. releaser-pleaser) already created via release.mode: keep-existing, and — when configured in .goreleaser.yaml — uploads through GitLab's package registry, so no external storage is needed.

Defaults GOTOOLCHAIN=auto, so goreleaser honours go.mod's toolchain directive and downloads the required Go for the release build (the bundled go-tools image's Go version may lag a project's pinned toolchain). Set gotoolchain: local to force the image's bundled Go instead.

Tag-gated by tag_pattern (RE2) — same shape as tofu-apply's and tofu-module-publish's tag_pattern. GIT_DEPTH: 0 is required — goreleaser walks the full commit history for changelog entries and snapshot version metadata.

Auto-retries transient failures (network blip, runner dropout, a notarization timestamp-server timeout) up to retry_max times — a single transient otherwise fails the entire release run and publishes zero assets; release.mode: keep-existing makes a retry idempotent.

Jobs

Job What it runs
goreleaser <goreleaser\|goreleaser-pro> $[[ inputs.args ]] (default release --clean) — the binary is goreleaser-pro when pro: true, else OSS goreleaser — with retry: { max: $[[ inputs.retry_max ]], when: [script_failure, runner_system_failure, stuck_or_timeout_failure] }.

Inputs

Input Type Default Description
image string go-tools:v0.5.0 Image to run goreleaser in (bundles OSS goreleaser + goreleaser-pro). Override with goreleaser/goreleaser:vX.Y to use upstream's bundled Go instead.
stage string release GitLab CI stage.
tag_pattern string '^v[0-9]+\.[0-9]+\.[0-9]+$' RE2 pattern a tag must match to run.
gotoolchain string "auto" auto resolves go.mod's toolchain directive; local forces the image's bundled Go; or pin a specific version e.g. go1.26.4.
args string "release --clean" Arguments passed to goreleaser. Add --skip=publish for staging runs.
pro boolean false Run goreleaser Pro (goreleaser-pro) instead of OSS goreleaser — required for Pro-only config (app_bundles, dmg, native notarize.macos_native, split/merge, partitioned builds). The go-tools image bundles both binaries. When true, set the GORELEASER_KEY CI/CD variable (the Pro licence).
retry_max number 2 Automatic retries on a transient failure. GitLab caps this at 2; 0 disables.
release_store_base_url string https://pkg.phpboyscout.uk Public base URL of the release binary store. The job refuses to run if this tag is already published there (colophon spec 0025 D13, cicd 0096). Empty disables the guard.
release_store_prefix string "" Key prefix the tag publishes under; empty derives <project path under the group>/<tag> (0025 D7). Override only if blobs.directory says otherwise.
release_store_sentinel string checksums.txt File whose presence means the tag is published. Written last by goreleaser, so a completed publish is protected and a died-mid-upload one can be re-run. Empty disables the guard.
release_store_access_key_id string $R2_RELEASE_ACCESS_KEY_ID Environment reference handed to goreleaser as AWS_ACCESS_KEY_ID for the blobs pipe (0025 D12/D16). Empty for a project that does not publish to the store.
release_store_secret_access_key string $R2_RELEASE_SECRET_ACCESS_KEY As above, for AWS_SECRET_ACCESS_KEY. A project that signs through KMS on OIDC blanks both on its sign command with signs.env (0025 D15).

Usage

include:
  - component: gitlab.com/phpboyscout/cicd/[email protected]

For a project with an embedded Svelte frontend built via go:generate (see Explanation: the Svelte frontend track), no extra wiring is needed — the go generate before-hook in .goreleaser.yaml builds the bundle. For a project using svelte-build instead, add:

goreleaser:
  needs:
    - job: svelte-build
      artifacts: true

goreleaser Pro

For a project whose .goreleaser.yaml uses Pro-only config — macOS .app bundles (app_bundles), .dmg (dmg), native notarization (notarize.macos_native), or split/merge partitioned builds — set pro: true and provide the GORELEASER_KEY licence as a CI/CD variable (group-level so it is shared across projects). The go-tools image bundles the goreleaser-pro binary alongside OSS goreleaser.

include:
  - component: gitlab.com/phpboyscout/cicd/[email protected]
    inputs:
      pro: true

macOS signing + notarization additionally require running on a macOS runner (codesign/notarytool are macOS-only) with the Apple Developer ID imported into a keychain and a notarytool credentials profile — those are consumer-side job overrides (tags, before_script), not component inputs.

See also