ci: add cross-platform E2E tests, SBOMs, Cosign, and GHCR Docker release

Signed-off-by: night-slayer18 <samanuaia257@gmail.com>

Author: night-slayer18

.github/workflows/release.yml

@@ -14,6 +14,10 @@ jobs:
   release:
     name: GoReleaser
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -26,6 +30,25 @@ jobs:
           go-version-file: go.mod
           cache-dependency-path: go.sum
 
+      - name: Install syft
+        uses: anchore/sbom-action/download-syft@v0.20.10
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3.4.0
+
+      - name: Login to ghcr.io registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:

.goreleaser.yml

@@ -59,7 +59,7 @@ nfpms:
       - archlinux
     bindir: /usr/bin
 
-brews:
+homebrews:
   - repository:
       owner: OpenSyntaxHQ
       name: homebrew-tweak
@@ -72,3 +72,29 @@ brews:
       bin.install "tweak"
     test: |
       system "#{bin}/tweak --version"
+
+dockers_v2:
+  - image_templates:
+      - "ghcr.io/opensyntaxhq/tweak:{{ .Version }}"
+      - "ghcr.io/opensyntaxhq/tweak:latest"
+    build_flag_templates:
+      - "--pull"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.title={{.ProjectName}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Version}}"
+
+sboms:
+  - artifacts: archive
+
+signs:
+  - cmd: cosign
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    args:
+      - "sign-blob"
+      - "--yes"
+      - "--output-signature=${signature}"
+      - "--output-certificate=${certificate}"
+      - "${artifact}"
+    artifacts: checksum

Dockerfile

@@ -0,0 +1,3 @@
+FROM scratch
+ENTRYPOINT ["/tweak"]
+COPY tweak /

tests/e2e_test.go

@@ -0,0 +1,101 @@
+package tests
+
+import (
+	"bytes"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestE2E(t *testing.T) {
+	binaryName := "tweak_e2e"
+	if runtime.GOOS == "windows" {
+		binaryName += ".exe"
+	}
+
+	buildCmd := exec.Command("go", "build", "-o", binaryName, "../main.go")
+	if err := buildCmd.Run(); err != nil {
+		t.Fatalf("Failed to build binary for E2E tests: %v", err)
+	}
+	defer os.Remove(binaryName)
+
+	binaryPath, err := filepath.Abs(binaryName)
+	if err != nil {
+		t.Fatalf("Failed to get absolute path for binary: %v", err)
+	}
+
+	tests := []struct {
+		name           string
+		args           []string
+		stdin          string
+		expectedOutput string
+		expectError    bool
+	}{
+		{
+			name:           "Base64 Encoding from Args",
+			args:           []string{"base64-encode", "hello world"},
+			expectedOutput: "aGVsbG8gd29ybGQ=",
+		},
+		{
+			name:           "Base64 Decoding from Stdin (Piping)",
+			args:           []string{"base64-decode"},
+			stdin:          "aGVsbG8gd29ybGQ=",
+			expectedOutput: "hello world",
+		},
+		{
+			name:           "MD5 Hash (Arg with spaces)",
+			args:           []string{"md5", "tweak test"},
+			expectedOutput: "4b284490e3437e4d4a48c09edb0040a0",
+		},
+		{
+			name:           "Uppercase transform",
+			args:           []string{"upper", "make me loud"},
+			expectedOutput: "MAKE ME LOUD",
+		},
+		{
+			name:           "Invalid Command Error",
+			args:           []string{"fake-command-123"},
+			expectError:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cmd := exec.Command(binaryPath, tt.args...)
+
+			// Set up stdin if provided (simulates bash/CMD piping: echo | tweak)
+			if tt.stdin != "" {
+				cmd.Stdin = strings.NewReader(tt.stdin)
+			}
+
+			var stdout bytes.Buffer
+			var stderr bytes.Buffer
+			cmd.Stdout = &stdout
+			cmd.Stderr = &stderr
+
+			err := cmd.Run()
+
+			if tt.expectError {
+				if err == nil {
+					t.Fatalf("Expected error but command succeeded. output: %s", stdout.String())
+				}
+				return
+			}
+
+			if err != nil {
+				t.Fatalf("Command failed: %v\nStderr: %s", err, stderr.String())
+			}
+
+			// Clean up output (CRLF to LF for cross-platform comparison)
+			got := strings.TrimSpace(stdout.String())
+			got = strings.ReplaceAll(got, "\r\n", "\n")
+
+			if got != tt.expectedOutput {
+				t.Errorf("\nGot:      %q\nExpected: %q", got, tt.expectedOutput)
+			}
+		})
+	}
+}