build(release): build the container image with melange + apko

.github/workflows/release-dry-run.yml

@@ -1,6 +1,6 @@
 # This workflow rehearses the release paths without uploading GitHub release
-# assets or publishing container images. It is intended for release PRs and
-# manual checks before changing release automation.
+# assets or publishing/signing container images. It is intended for release PRs
+# and manual checks before changing release automation.
 #
 # Keep the pull_request trigger broad so required check contexts still report
 # on normal PRs. The jobs intentionally skip unless the PR head branch is a
@@ -33,7 +33,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: .go-version
+          go-version-file: go.mod
           cache: true
 
       - name: Install Syft
@@ -128,8 +128,10 @@ jobs:
             *) echo "unexpected version output: $output" >&2; exit 1 ;;
           esac
 
-  container-image-platform-dry-run:
-    name: Container Image Platform Dry Run (${{ matrix.platform }})
+  # Rehearse the container build: build per-arch signed apks on native runners and
+  # assemble the image with apko, WITHOUT pushing, signing, or attesting.
+  melange-build-dry-run:
+    name: Melange Build Dry Run (${{ matrix.arch }})
     if: ${{ github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please--') }}
     runs-on: ${{ matrix.runner }}
     permissions:
@@ -138,70 +140,82 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - platform: linux/amd64
+          - arch: amd64
             runner: ubuntu-24.04
-            arch: amd64
-          - platform: linux/arm64
+            apkdir: x86_64
+          - arch: arm64
             runner: ubuntu-24.04-arm
-            arch: arm64
+            apkdir: aarch64
     steps:
       - name: Check out repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
 
+      - name: Setup mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        with:
+          version: 2026.6.14
+          cache: true
+
       - name: Resolve dry-run metadata
         id: dry-run
         env:
           DRY_RUN_VERSION: 0.0.0-dryrun.${{ github.run_id }}.${{ github.run_attempt }}
         run: |
           set -euo pipefail
-
           echo "version=${DRY_RUN_VERSION}" >> "$GITHUB_OUTPUT"
           echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
           echo "date=$(git show -s --format=%cI HEAD)" >> "$GITHUB_OUTPUT"
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - name: Write melange vars file
+        env:
+          VERSION: ${{ steps.dry-run.outputs.version }}
+          COMMIT: ${{ steps.dry-run.outputs.commit }}
+          DATE: ${{ steps.dry-run.outputs.date }}
+        run: |
+          printf 'version: "%s"\ncommit: "%s"\ndate: "%s"\n' "$VERSION" "$COMMIT" "$DATE" > melange-vars.yaml
+
+      - name: Generate ephemeral signing key
+        run: melange keygen "melange-${{ matrix.arch }}.rsa"
 
-      - name: Build platform OCI archive
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      - name: Build signed apk
+        run: |
+          melange build melange.yaml \
+            --arch ${{ matrix.arch }} \
+            --runner docker \
+            --signing-key "melange-${{ matrix.arch }}.rsa" \
+            --source-dir . \
+            --vars-file melange-vars.yaml
+
+      - name: Upload apk and public key
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          context: .
-          push: false
-          platforms: ${{ matrix.platform }}
-          outputs: type=oci,dest=/tmp/template-go-api-dry-run-${{ matrix.arch }}.oci
-          provenance: mode=max
-          sbom: true
-          cache-from: type=gha,scope=template-go-api-release-dry-run-${{ matrix.arch }}
-          cache-to: type=gha,mode=max,scope=template-go-api-release-dry-run-${{ matrix.arch }}
-          build-args: |
-            VERSION=${{ steps.dry-run.outputs.version }}
-            COMMIT=${{ steps.dry-run.outputs.commit }}
-            DATE=${{ steps.dry-run.outputs.date }}
-            SOURCE=https://github.com/${{ github.repository }}
-
-      - name: Validate platform OCI archive
-        run: test -s /tmp/template-go-api-dry-run-${{ matrix.arch }}.oci
+          name: apk-${{ matrix.arch }}
+          path: |
+            packages/${{ matrix.apkdir }}/**
+            melange-${{ matrix.arch }}.rsa.pub
+          if-no-files-found: error
+          retention-days: 1
 
   container-image-dry-run:
     name: Container Image Dry Run
     needs:
-      - container-image-platform-dry-run
+      - melange-build-dry-run
     if: ${{ always() && (github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please--')) }}
     runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:
-      - name: Check platform dry-run result
+      - name: Check melange dry-run result
         env:
-          PLATFORM_RESULT: ${{ needs.container-image-platform-dry-run.result }}
+          MELANGE_RESULT: ${{ needs.melange-build-dry-run.result }}
         run: |
           set -euo pipefail
 
-          if [ "$PLATFORM_RESULT" != "success" ]; then
-            echo "container platform dry-run result was $PLATFORM_RESULT" >&2
+          if [ "$MELANGE_RESULT" != "success" ]; then
+            echo "melange dry-run result was $MELANGE_RESULT" >&2
             exit 1
           fi
 
@@ -211,47 +225,30 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      - name: Resolve dry-run metadata
-        id: dry-run
-        env:
-          DRY_RUN_VERSION: 0.0.0-dryrun.${{ github.run_id }}.${{ github.run_attempt }}
-        run: |
-          set -euo pipefail
-
-          echo "version=${DRY_RUN_VERSION}" >> "$GITHUB_OUTPUT"
-          echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-          echo "date=$(git show -s --format=%cI HEAD)" >> "$GITHUB_OUTPUT"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-
-      - name: Build Docker test target
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      - name: Setup mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
         with:
-          context: .
-          target: test
-          push: false
-          cache-from: type=gha,scope=template-go-api-release-dry-run-amd64
-          cache-to: type=gha,mode=max,scope=template-go-api-release-dry-run-amd64
-
-      - name: Build local smoke-test image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+          version: 2026.6.14
+          cache: true
+
+      - name: Download per-arch apks and public keys
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          context: .
-          load: true
-          platforms: linux/amd64
-          tags: template-go-api:dry-run
-          cache-from: type=gha,scope=template-go-api-release-dry-run-amd64
-          cache-to: type=gha,mode=max,scope=template-go-api-release-dry-run-amd64
-          build-args: |
-            VERSION=${{ steps.dry-run.outputs.version }}
-            COMMIT=${{ steps.dry-run.outputs.commit }}
-            DATE=${{ steps.dry-run.outputs.date }}
-            SOURCE=https://github.com/${{ github.repository }}
-
-      - name: Smoke test local image
+          pattern: apk-*
+          path: .
+          merge-multiple: true
+
+      - name: Assemble image and smoke test (no push)
         run: |
           set -euo pipefail
 
+          apko build apko.yaml template-go-api:dry-run image.tar \
+            --arch amd64 \
+            --keyring-append ./melange-amd64.rsa.pub \
+            --keyring-append ./melange-arm64.rsa.pub
+
+          docker load < image.tar
+          docker tag template-go-api:dry-run-amd64 template-go-api:dry-run
+
           docker run --rm template-go-api:dry-run --version
           docker run --rm template-go-api:dry-run openapi | grep -Fq "openapi: 3.0.3"