ci: add goreleaser

[MeteorsLiu]

No description provided.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fennoai]

Review: ci: add goreleaser

This PR adds a tag-triggered GoReleaser release pipeline. The setup is clean and follows standard conventions — fetch-depth: 0 for changelog access, minimal contents: write permission, CGO_ENABLED=0 + mod_timestamp for reproducible static builds, and checksum generation. A few points worth addressing before merge; see inline comments plus the notes below.

Main finding (inline): the explicit ldflags in .goreleaser.yaml fully replaces GoReleaser's defaults, dropping version/commit/date injection. Worth confirming whether llar embeds a version.

Supply chain (inline): actions are pinned to mutable major tags rather than commit SHAs.

Additional non-blocking notes

• Job-level permissions (release.yml:8-9): permissions: contents: write is correctly scoped and required by GoReleaser. As defense-in-depth, consider moving it under the release job so only that job receives the write-scoped token — prevents scope creep if more jobs are added later.
• Go version source (release.yml:22): go-version: 1.24.x floats to the latest 1.24 patch. Since this project depends on internal linkname compatibility (-checklinkname=0), go-version-file: go.mod would give a single source of truth and reduce drift risk. Minor.
• Platform coverage (.goreleaser.yaml:11-16): only darwin/linux are built. If omitting Windows is intentional, no change needed — flagging only to confirm it's deliberate. If Windows is added later, a zip format_overrides for Windows is the usual convention.

No performance concerns found. LICENSE and README.md (referenced in the archive) both exist at the repo root.

[luoliwoshang]

LGTM https://github.com/MeteorsLiu/llar/releases