fix: Use musl libs for static binary

.github/actions/publish/action.yml

@@ -40,6 +40,7 @@ runs:
       # We're using the goreleaser-cross image to facilitate this. See also: https://github.com/goreleaser/goreleaser-cross
       shell: bash
       run: |
+        set -x
         CONTAINER_ID="$(
           docker run --detach \
             --volume "$PWD:$PWD" \
@@ -48,9 +49,10 @@ runs:
             ghcr.io/goreleaser/goreleaser-cross:latest \
               -f /dev/null
         )"
-        docker exec --tty "$CONTAINER_ID" dpkg --add-architecture i386
-        docker exec --tty "$CONTAINER_ID" apt-get update
-        docker exec --tty "$CONTAINER_ID" apt-get install --no-install-recommends -y -q crossbuild-essential-i386
+        docker exec --tty "$CONTAINER_ID" mkdir -p /musl
+        docker exec --tty "$CONTAINER_ID" bash -euo pipefail -c 'curl --retry 5 --retry-all-errors --retry-delay 5 -fsSL https://musl.cc/aarch64-linux-musl-cross.tgz -o- | tar -zxvf - -C /musl --strip-components=1'
+        docker exec --tty "$CONTAINER_ID" bash -euo pipefail -c 'curl --retry 5 --retry-all-errors --retry-delay 5 -fsSL https://musl.cc/i686-linux-musl-cross.tgz -o- | tar -zxvf - -C /musl --strip-components=1'
+        docker exec --tty "$CONTAINER_ID" bash -euo pipefail -c 'curl --retry 5 --retry-all-errors --retry-delay 5 -fsSL https://musl.cc/x86_64-linux-musl-cross.tgz -o- | tar -zxvf - -C /musl --strip-components=1'
         docker exec --tty "$CONTAINER_ID" git config --global --add safe.directory '*'
         docker exec --workdir "$PWD" --tty "$CONTAINER_ID" docker login --username $DOCKER_USERNAME --password $DOCKER_TOKEN
         echo "CONTAINER_ID=$CONTAINER_ID" >> "$GITHUB_ENV"

.github/workflows/release-please.yml

@@ -1,6 +1,7 @@
 name: Run Release Please
 
 on:
+  pull_request:
   push:
     branches:
       - main
@@ -11,6 +12,7 @@ jobs:
 
   release-please:
     runs-on: ubuntu-latest
+    if: github.event_name == 'push'
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
@@ -25,7 +27,7 @@ jobs:
       id-token: write # Needed to obtain Docker tokens
       contents: write # Needed to upload release artifacts
     needs: [ release-please, go-versions ]
-    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    if: always() && (needs.release-please.outputs.release_created == 'true' || github.event_name == 'pull_request')
     runs-on: ubuntu-latest
     outputs:
       hashes: ${{ steps.publish.outputs.hashes }}
@@ -49,7 +51,8 @@ jobs:
       - uses: ./.github/actions/publish
         id: publish
         with:
-          dry-run: 'false'
+          dry-run: ${{ github.event_name == 'pull_request' }}
+          snapshot: ${{ github.event_name == 'pull_request' }}
           token: ${{ secrets.GITHUB_TOKEN }}
           homebrew-gh-secret: ${{secrets.HOMEBREW_DEPLOY_KEY}}
           tag: ${{ needs.release-please.outputs.tag_name }}
@@ -60,7 +63,7 @@ jobs:
     permissions:
       id-token: write
       contents: write
-    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    if: always() && needs.release-please.outputs.release_created == 'true'
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v3
@@ -76,7 +79,7 @@ jobs:
         name: Publish NPM Package
         uses: ./.github/actions/publish-npm
         with:
-          dry-run: 'false'
+          dry-run: ${{ github.event_name == 'pull_request' }}
           prerelease: 'false'
 
   release-ldcli-provenance:

.goreleaser.yaml

@@ -6,6 +6,25 @@ env:
   - GO111MODULE=on # Ensure we aren't using anything in GOPATH when building
   - CGO_ENABLED=1 # Needed for SQLite support
   - DOCKER_CLI_EXPERIMENTAL=enabled # This is on by default in docker versions >= 20.10
+  # Paths to compiler toolchains for each target OS/ARCH. If new items are added to GOOS/GOACH in the build,
+  # they should also be added here.
+  # In the future we can use musl for w64-mingw32 too, currently missing is only aarch64.
+  - CC_windows_386=/llvm-mingw/bin/i686-w64-mingw32-gcc
+  - CXX_windows_386=/llvm-mingw/bin/i686-w64-mingw32-g++
+  - CC_windows_amd64=/llvm-mingw/bin/x86_64-w64-mingw32-gcc
+  - CXX_windows_amd64=/llvm-mingw/bin/x86_64-w64-mingw32-g++
+  - CC_windows_arm64=/llvm-mingw/bin/aarch64-w64-mingw32-gcc
+  - CXX_windows_arm64=/llvm-mingw/bin/aarch64-w64-mingw32-g++
+  - CC_linux_386=/musl/bin/i686-linux-musl-gcc
+  - CXX_linux_386=/musl/bin/i686-linux-musl-g++
+  - CC_linux_amd64=/musl/bin/x86_64-linux-musl-gcc
+  - CXX_linux_amd64=/musl/bin/x86_64-linux-musl-g++
+  - CC_linux_arm64=/musl/bin/aarch64-linux-musl-gcc
+  - CXX_linux_arm64=/musl/bin/aarch64-linux-musl-g++
+  - CC_darwin_amd64=/usr/local/osxcross/bin/o64-clang
+  - CXX_darwin_amd64=/usr/local/osxcross/bin/o64-clang++
+  - CC_darwin_arm64=/usr/local/osxcross/bin/oa64-clang
+  - CXX_darwin_arm64=/usr/local/osxcross/bin/oa64-clang++
 
 builds:
   - id: ldcli
@@ -22,28 +41,16 @@ builds:
       - -s # Omit all symbol information to minimize binary size
       - -w # Omit DWARF to minimize binary size
       - -X 'main.version={{.Version}}'
+      - '{{ if eq .Os "linux" }}-extldflags "-static"{{ end }}'
     ignore:
       - goos: darwin
         goarch: "386"
     env:
       # The below environment variables set up the c compiler toolchain for CGO.
       # Templates are used to vary the toolchain based on OS & platform.
-      - TOOLCHAIN_BASE=
-        {{- if eq .Os "darwin" -}}
-          o
-          {{- if eq .Arch "arm64" -}}a{{- end -}}
-          64-clang
-        {{- else -}}
-          {{- if eq .Os "windows" -}}/llvm-mingw/bin/{{- end -}}
-          {{- if eq .Arch "386" -}}i686{{- end -}}
-          {{- if eq .Arch "arm64" -}}aarch64{{- end -}}
-          {{- if eq .Arch "amd64" -}}x86_64{{- end -}}
-          -
-          {{- if eq .Os "windows" -}}w64-mingw32{{- end -}}
-          {{- if eq .Os "linux" -}}linux-gnu{{- end -}}
-        {{- end -}}
-      - CC={{ .Env.TOOLCHAIN_BASE }}{{ if ne .Os "darwin" }}-gcc{{ end }}
-      - CXX={{ .Env.TOOLCHAIN_BASE }}{{ if eq .Os "darwin" }}++{{ else }}-g++{{ end }}
+      # The real values are defined by the CC_<OS>_<ARCH> env vars defined at the top `env` attribute.
+      - 'CC={{ index .Env (print "CC_" .Os "_" .Arch) }}'
+      - 'CXX={{ index .Env (print "CXX_" .Os "_" .Arch) }}'
 
 dockers:
   # AMD64