From f7bce961717cc8a45d1059c38414db5047e068d0 Mon Sep 17 00:00:00 2001
From: Jonas Kaninda <jonaskaninda@gmail.com>
Date: Mon, 13 Jul 2026 21:35:41 +0200
Subject: [PATCH] ci(agent): ship Linux and macOS binaries with GoReleaser

---
 .github/workflows/release.yml | 26 ++++++++++
 .gitignore                    |  3 ++
 .goreleaser.yaml              | 91 +++++++++++++++++++++++++++++++++++
 go.mod                        |  2 +-
 4 files changed, 121 insertions(+), 1 deletion(-)
 create mode 100644 .goreleaser.yaml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aa1537a..0d52c9a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,6 +9,32 @@ permissions:
   packages: write
 
 jobs:
+  # Downloadable binaries, for running the agent as a host process (systemd, launchd)
+  # rather than as a container. Linux and macOS only — the agent reaches Docker over a
+  # unix socket or TCP, and Windows serves its daemon on a named pipe, so a Windows
+  # build would run and then never find Docker.
+  binaries:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # create the GitHub release and upload the archives
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # full history so the changelog can diff against prior tags
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   image:
     runs-on: ubuntu-latest
     steps:
diff --git a/.gitignore b/.gitignore
index f33f695..b8e5aa1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,6 @@
 /miabi-agent
 /agent
 *.exe
+
+# GoReleaser build output
+/dist/
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
new file mode 100644
index 0000000..ec2927b
--- /dev/null
+++ b/.goreleaser.yaml
@@ -0,0 +1,91 @@
+# GoReleaser config for the Miabi node agent.
+#
+# The container image stays the primary way to run the agent (see Dockerfile and
+# install-agent.sh) — it is what the cluster-wide global service ships to every swarm
+# worker. These binaries are for the other case: running the agent as a host process
+# under systemd/launchd, on a node where you would rather not add a container to
+# supervise the containers.
+#
+# Release:  goreleaser release --clean   (on a tag)
+# Snapshot: goreleaser build --snapshot --clean
+version: 2
+
+project_name: miabi-agent
+
+before:
+  hooks:
+    - go mod tidy
+
+builds:
+  - id: miabi-agent
+    main: .
+    binary: miabi-agent
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+    # Linux and macOS only, and Windows is a deliberate omission rather than an
+    # oversight: the agent reaches Docker over `unix://` or `tcp://` (see dialDocker),
+    # and Windows serves its daemon on a named pipe (npipe://). A Windows binary would
+    # build cleanly and then fail to find Docker on every machine it ran on, which is
+    # worse than not shipping one.
+    goos: [linux, darwin]
+    goarch: [amd64, arm64]
+    ldflags:
+      - -s -w
+      - -X main.version={{ .Version }}
+    mod_timestamp: "{{ .CommitTimestamp }}"
+
+archives:
+  - id: miabi-agent
+    ids: [miabi-agent]
+    name_template: "miabi-agent_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    formats: [tar.gz]
+    files:
+      - LICENSE
+      - README.md
+
+checksum:
+  name_template: "checksums.txt"
+
+snapshot:
+  version_template: "{{ incpatch .Version }}-dev"
+
+changelog:
+  use: github
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+      - "^chore:"
+      - "^ci:"
+      - "Merge pull request"
+      - "Merge branch"
+
+release:
+  github:
+    owner: miabi-io
+    name: agent
+  prerelease: auto
+  name_template: "Miabi Agent {{ .Tag }}"
+  footer: |
+    ---
+
+    ## Container image
+
+    The agent is normally run as a container — that is what the installer and the
+    cluster-wide agent service use:
+
+        docker run -d --name miabi-agent --restart unless-stopped \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -e MIABI_CONTROL_URL=https://miabi.example.com \
+          -e MIABI_NODE_TOKEN=mbn_xxxxxxxx \
+          miabi/agent:{{ .Version }}
+
+    Images are published to Docker Hub (`miabi/agent`) and GHCR
+    (`ghcr.io/miabi-io/agent`), tagged `latest` and `{{ .Version }}`.
+
+    The binaries above are for running the agent directly on a host (systemd, launchd)
+    instead of in a container. They need the same two settings, plus a reachable Docker
+    socket — and, behind a private CA, `MIABI_CA_CERT`.
diff --git a/go.mod b/go.mod
index 03caa17..fb143d4 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/miabi-io/miabi-agent
 go 1.25.0
 
 require (
-	github.com/gorilla/websocket v1.5.3 // indirect
+	github.com/gorilla/websocket v1.5.3
 	github.com/hashicorp/yamux v0.1.2
 )