ci: add cross-platform E2E tests, SBOMs, Cosign, and GHCR Docker release

Signed-off-by: night-slayer18 <samanuaia257@gmail.com>

Author: night-slayer18

.github/workflows/release.yml

@@ -14,6 +14,10 @@ jobs:
   release:
     name: GoReleaser
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -26,6 +30,25 @@ jobs:
           go-version-file: go.mod
           cache-dependency-path: go.sum
 
+      - name: Install syft
+        uses: anchore/sbom-action/download-syft@v0.20.10
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3.4.0
+
+      - name: Login to ghcr.io registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:
@@ -34,3 +57,4 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}

.goreleaser.yml

@@ -59,16 +59,41 @@ nfpms:
       - archlinux
     bindir: /usr/bin
 
-brews:
+homebrew_casks:
   - repository:
       owner: OpenSyntaxHQ
       name: homebrew-tweak
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
     name: tweak
     homepage: "https://github.com/OpenSyntaxHQ/tweak"
-    description: "A cross-platform CLI for 118+ text transformations."
-    license: "Apache-2.0"
-    skip_upload: auto
-    install: |-
-      bin.install "tweak"
-    test: |
-      system "#{bin}/tweak --version"
+    description: "Fast CLI + TUI for text processing: encoding, hashing, transforms, and more."
+
+dockers_v2:
+  - images:
+      - "ghcr.io/opensyntaxhq/tweak"
+    tags:
+      - "{{ .Version }}"
+      - "latest"
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    labels:
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.title: "{{.ProjectName}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Version}}"
+
+sboms:
+  - artifacts: archive
+
+signs:
+  - cmd: cosign
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    args:
+      - "sign-blob"
+      - "--yes"
+      - "--output-signature=${signature}"
+      - "--output-certificate=${certificate}"
+      - "${artifact}"
+    artifacts: checksum

Dockerfile

@@ -0,0 +1,5 @@
+FROM scratch
+ARG TARGETOS
+ARG TARGETARCH
+COPY ${TARGETOS}/${TARGETARCH}/tweak /
+ENTRYPOINT ["/tweak"]

tests/e2e_test.go

@@ -0,0 +1,101 @@
+package tests
+
+import (
+	"bytes"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestE2E(t *testing.T) {
+	binaryName := "tweak_e2e"
+	if runtime.GOOS == "windows" {
+		binaryName += ".exe"
+	}
+
+	buildCmd := exec.Command("go", "build", "-o", binaryName, "../main.go")
+	if err := buildCmd.Run(); err != nil {
+		t.Fatalf("Failed to build binary for E2E tests: %v", err)
+	}
+	defer os.Remove(binaryName)
+
+	binaryPath, err := filepath.Abs(binaryName)
+	if err != nil {
+		t.Fatalf("Failed to get absolute path for binary: %v", err)
+	}
+
+	tests := []struct {
+		name           string
+		args           []string
+		stdin          string
+		expectedOutput string
+		expectError    bool
+	}{
+		{
+			name:           "Base64 Encoding from Args",
+			args:           []string{"base64-encode", "hello world"},
+			expectedOutput: "aGVsbG8gd29ybGQ=",
+		},
+		{
+			name:           "Base64 Decoding from Stdin (Piping)",
+			args:           []string{"base64-decode"},
+			stdin:          "aGVsbG8gd29ybGQ=",
+			expectedOutput: "hello world",
+		},
+		{
+			name:           "MD5 Hash (Arg with spaces)",
+			args:           []string{"md5", "tweak test"},
+			expectedOutput: "4b284490e3437e4d4a48c09edb0040a0",
+		},
+		{
+			name:           "Uppercase transform",
+			args:           []string{"upper", "make me loud"},
+			expectedOutput: "MAKE ME LOUD",
+		},
+		{
+			name:           "Invalid Command Error",
+			args:           []string{"fake-command-123"},
+			expectError:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cmd := exec.Command(binaryPath, tt.args...)
+
+			// Set up stdin if provided (simulates bash/CMD piping: echo | tweak)
+			if tt.stdin != "" {
+				cmd.Stdin = strings.NewReader(tt.stdin)
+			}
+
+			var stdout bytes.Buffer
+			var stderr bytes.Buffer
+			cmd.Stdout = &stdout
+			cmd.Stderr = &stderr
+
+			err := cmd.Run()
+
+			if tt.expectError {
+				if err == nil {
+					t.Fatalf("Expected error but command succeeded. output: %s", stdout.String())
+				}
+				return
+			}
+
+			if err != nil {
+				t.Fatalf("Command failed: %v\nStderr: %s", err, stderr.String())
+			}
+
+			// Clean up output (CRLF to LF for cross-platform comparison)
+			got := strings.TrimSpace(stdout.String())
+			got = strings.ReplaceAll(got, "\r\n", "\n")
+
+			if got != tt.expectedOutput {
+				t.Errorf("\nGot:      %q\nExpected: %q", got, tt.expectedOutput)
+			}
+		})
+	}
+}