Add GitHub CD release build workflow

[ffranr]

This new release build workflow is triggered when a new git tag is pushed.

Closes #307

[ffranr]

I still need to give this another once over. But it's probably correct.

EDIT: OK, I've done that, still seems ok. I'll now request reviews.

[GeorgeTsagk]

Lgtm, cross-checked with what we use in lnd and seems to make sense
guess we just have to test it out live now 💯

[ffranr]

I've tried to recreate the manifest file for release v0.3.1 but the hashes did not match. My steps were:

1. Clone repo into a new directory.
2. Checkout tag v0.3.1
3. Run make docker-release tag=v0.3.1

The hashes I got were:

6f12145f93d0c3017b945593897dc6fc6d4fb2149922879e02e9da2c007cc89d  taproot-assets-darwin-amd64-v0.3.1.tar.gz
49d0eb519d321f227e1cf1adfc7ac1735a21033ad85038bf9a276558a275d6f4  taproot-assets-darwin-amd64-v0.3.1/tapcli
0bb9a737430ecb071727e6863cde5fe52268602a45b40f82c740569a0c4dbdd1  taproot-assets-darwin-amd64-v0.3.1/tapd
4b69f13198df7ddb901de72b063a00b0fdd05c6a47fcc9ac70c4be9b2cbeb4f1  taproot-assets-darwin-arm64-v0.3.1.tar.gz
41f2b05b88dfddce298c7b255ed233fc55f8ef49dd99a00f4cd0f5c8913e3452  taproot-assets-darwin-arm64-v0.3.1/tapcli
3453038aea839769c667345d92cb2ab6b7cef8b3d81bd73ec72668f72aca8706  taproot-assets-darwin-arm64-v0.3.1/tapd
5cf49317081ece5121acf3409458722e401d5f68f963d7ca22c880049e86e656  taproot-assets-linux-386-v0.3.1.tar.gz
808f7825030572423c0553a9e2f3eb05a3ad461869c8d82405fc26cb22dde029  taproot-assets-linux-386-v0.3.1/tapcli
59c08bc9e417eab587516bd1c61451104434a757c36c180074cc5b825f99a1d5  taproot-assets-linux-386-v0.3.1/tapd
1e28e6d50f18b9a26649ae9ab044a5e9890741de0f6fafca97b6221d80d06229  taproot-assets-linux-amd64-v0.3.1.tar.gz
b180f9b2b7c1b6854817f5579cb58a634bd67b5a749ae8a893f3c2087cb1ae6a  taproot-assets-linux-amd64-v0.3.1/tapcli
13ba43339b667002dc4c5d084f0359380d5bda9e29e9b0d2103dce4a51eae640  taproot-assets-linux-amd64-v0.3.1/tapd
c874d683a7e0d9a543a1e5b36c77311641e05037e9f11c390355690b2de038fc  taproot-assets-linux-arm64-v0.3.1.tar.gz
b8b12744b320834b8a70736713b40b9830d99e8d4f9977e71b228d42d5f25a18  taproot-assets-linux-arm64-v0.3.1/tapcli
4c448d8eea4a82157ffb08ca7946724842749ad21bb26c7aff25333179c3b68d  taproot-assets-linux-arm64-v0.3.1/tapd
ab8e00e649e8f0d56d3c0ffd14581add0386713e06cabea53dedca0812e20cbb  taproot-assets-linux-armv6-v0.3.1.tar.gz
2b3c55a962301d1bd873c01237717391947400a6ff5664632960aac1085f97d6  taproot-assets-linux-armv6-v0.3.1/tapcli
07206514db463fadf69906f8f2c78435982c43a9108bab9d413fcfaa5f0e2684  taproot-assets-linux-armv6-v0.3.1/tapd
3712db9cfab81927a1de3283867cd89ddd4d9a3a170f167f1334abf80ed1c3eb  taproot-assets-linux-armv7-v0.3.1.tar.gz
c47cf6a9db9126a8eb29352472cb5cafdc5a12f679a1a9e22335c56799f16f6d  taproot-assets-linux-armv7-v0.3.1/tapcli
55b60d17ba59531487d1b89db1ab44c381ad2f5b13e39f4ff77e19d70300331a  taproot-assets-linux-armv7-v0.3.1/tapd
e6cfb00e20c082f9e82c9307faf27dea981c12a58e1ee907027af98d20435dfe  taproot-assets-source-v0.3.1.tar.gz
f812416a76b487877262277550ae4f06d6d3bed47d9c1d871ac71b8ac32e8018  taproot-assets-windows-amd64-v0.3.1.zip
f4885eafd2e584bc0906998508abb447cb5bb5efdbbd6d088d1b7f3d37d31911  taproot-assets-windows-amd64-v0.3.1/tapcli.exe
ca11ccd02cb323d98d8693b9de70eecc37432226a791564436a0b0c6bafaf335  taproot-assets-windows-amd64-v0.3.1/tapd.exe
8edf48efb62caf6ff60ab8ec69ce08b1d734ce45291ee59bd2071098f03542e7  vendor.tar.gz

Any ideas where I've gone wrong @jharveyb @Roasbeef ?

[jharveyb]

Any ideas where I've gone wrong @jharveyb @Roasbeef ?

My build returned the same hashes as ffranr.

[jharveyb]

My build returned the same hashes as ffranr.

I also did a build locally after installing go 1.21.0 manually with these tools: https://go.dev/doc/manage-install

And set that as the default go toolchain. The manifest for that local build matches my docker build and the manifest posted above.

[ffranr]

The 0.3.1 release manifest hashes don't seem to matchup on individual binaries. For example, locally I generated:

13ba43339b667002dc4c5d084f0359380d5bda9e29e9b0d2103dce4a51eae640  taproot-assets-linux-amd64-v0.3.1/tapd

Where as the manifest file here on the release page I see:

979eb741622ef6a928c486ae3afcc73579ae931e659d1b6f36aec9e781fb44f5  taproot-assets-linux-amd64-v0.3.1/tapd

[jharveyb]

Solid updates!

I tested verify-install.sh for v0.3.0 and it correctly picked up the 3 posted sigs + all keys.

Final nit would be to rename the new scripts + targets for go versioning check, since we aren't actually linting the Dockerfiles or GH workflow files, just version checking. Non-blocking.

[jharveyb]

We should resolve reproducible builds for v0.3.1 before merging this though.

[GeorgeTsagk]

LGTM

[ffranr]

@jharveyb

Tag v0.3.1 is at commit fec4a4025db21d2e47994ad4bff29aa5d31d02e9. And when I attempted to build the release the resultant manifest hashes did not match up to those found on the GitHub release page. This is what I reported here.

I spoke to @Roasbeef and he said that his staging environment where he built the release assets was at commit cdd6707702788cccfe615be3b06fe34a96ce31c6. I've managed to rebuild the release locally with this in mind. I created a new local tag (v0.3.1) at commit cdd6707702788cccfe615be3b06fe34a96ce31c6. And then I ran make docker-release tag=v0.3.1 as before. And now all of the manifest hashes match those found on the v0.3.1 release page.

So I think make docker-release does work correctly. The manifest hashes on the v0.3.1 release page match up with commit cdd6707702788cccfe615be3b06fe34a96ce31c6 and not with tag v0.3.1. Commit cdd6707702788cccfe615be3b06fe34a96ce31c6 is one behind the commit tagged with v0.3.1 (fec4a4025db21d2e47994ad4bff29aa5d31d02e9).

[GeorgeTsagk]

My local build hashes for v0.3.1 match those reported here by @ffranr #661 (comment)