[aperezg]

Summary

Modernize release tooling while preserving binary names, archive formats, checksums, and supported build targets.

Changes

• Upgrade to GoReleaser v2.19.0 and migrate its configuration to version 2.
• Pin GoReleaser and Docker actions to full commit SHAs.
• Share validation between pull requests, CI, and tagged releases.
• Require tests, race detection, vet, vulnerability scans, snapshot packaging, and Docker checks before publishing.
• Restrict GitHub write permissions to the release publishing job.
• Migrate Homebrew publishing from formulas to casks.
• Make Docker builds independent of Git history, with explicit version arguments and cached dependency downloads.
• Verify archive names, contents, and checksums for all 12 supported targets.
• Add Dependabot updates for GitHub Actions and Docker images.

Validation

• Passed unit tests with race detection.
• Passed static checks and acceptance tests.
• Found no vulnerabilities in production or acceptance code.
• Passed workflow validation with actionlint.
• Built and inspected all 12 snapshot archives.
• Passed acceptance tests against the packaged macOS ARM64 binary.
• Generated the Homebrew cask successfully.

Docker execution and Homebrew installation/upgrade checks remain pending.

Release coordination

Merge the companion homebrew-tap migration before creating the release tag. It adds the cask and upgrade mapping and removes the old formula.

New Homebrew installation command:

brew install --cask friendsofgo/tap/killgrave