feat: release on windows

[willmurphyscode]

Support windows by:

1. Changing goreleaser config to make windows release artifacts
2. Changing PR and pre-release validations to run new CLI tests on windows runner

Closes #17

[willmurphyscode]

Something isn't working with the Windows validations:

  make test
  shell: C:\Program Files\PowerShell\7\pwsh.EXE -command ". '{0}'"
  env:
    FORCE_COLOR: true
bash: line 1: .tool/task: No such file or directory
bash: line 1: .tool/task: No such file or directory
make: 'test' is up to date.

It looks like the windows validations just didn't do anything, but still turned green (https://github.com/anchore/binny/actions/runs/9022127458/job/24790946459?pr=22#step:4:9).

Maybe making the test target depend on the tools target is enough?

[kzantow]

I tested the snapshot build on windows and the current state of the PR seems to work as expected:

PS C:\Users\kzantow\projects\binny> make snapshot     
[dependencies:quill] building local binny from C:\Users\kzantow\projects\binny\cmd\binny
[dependencies:quill] $ go build -o C:\Users\kzantow\projects\binny\.tool\binny.exe C:\Users\kzantow\projects\binny\cmd\binny
[dependencies:quill] binny installed: quill at C:\Users\kzantow\projects\binny\.tool\quill.exe
[dependencies:syft] binny installed: syft at C:\Users\kzantow\projects\binny\.tool\syft.exe
[dependencies:cosign] binny installed: cosign at C:\Users\kzantow\projects\binny\.tool\cosign.exe
[snapshot] binny installed: goreleaser at C:\Users\kzantow\projects\binny\.tool\goreleaser.exe
[snapshot] $ .tool\goreleaser.exe release --clean --snapshot --skip=publish --skip=sign --config=C:\Users\kzantow\AppData\Local\Temp\buildtools-tmp-296158715\.goreleaser.yaml
  • starting release
  • only version: 2 configuration files are supported, yours is version: 0, please update your configuration
  • skipping announce, publish, sign, and validate...
  • cleaning distribution directory
  • loading environment variables
  • getting and validating git state
    • using tags                                     previous=v0.13.1 current=v0.13.2
    • pipe skipped or partially skipped              reason=disabled during snapshot mode
  • parsing tag
  • setting defaults
    • DEPRECATED: archives.builds should not be used anymore, check https://goreleaser.com/deprecations#archivesbuilds for more info
    • DEPRECATED: archives.format should not be used anymore, check https://goreleaser.com/deprecations#archivesformat for more info
  • snapshotting
    • building snapshot...                           version=0.13.2-SNAPSHOT-b19adec
  • ensuring distribution directory
  • setting up metadata
  • writing release metadata
  • loading go mod information
  • build prerequisites
  • building binaries
    • building                                       paths=cmd\binny binaries=binny target=darwin_amd64_v1
    • building                                       paths=cmd\binny binaries=binny target=linux_amd64_v1
    • building                                       paths=cmd\binny binaries=binny target=windows_amd64_v1
    • building                                       paths=cmd\binny binaries=binny target=linux_riscv64_rva20u64
    • building                                       paths=cmd\binny binaries=binny target=darwin_arm64_v8.0
    • building                                       paths=cmd\binny binaries=binny target=linux_arm64_v8.0
    • running hook                                   hook=.tool/quill sign-and-notarize "C:\Users\kzantow\projects\binny\snapshot\darwin-build_darwin_arm64_v8.0\binny" --dry-run=true --ad-hoc=true -vv
    • running hook                                   hook=.tool/quill sign-and-notarize "C:\Users\kzantow\projects\binny\snapshot\darwin-build_darwin_amd64_v1\binny" --dry-run=true --ad-hoc=true -vv
      • took: 1m22s
  • archives
    • archiving                                      name=snapshot\binny_0.13.2-SNAPSHOT-b19adec_linux_amd64.tar.gz
    • archiving                                      name=snapshot\binny_0.13.2-SNAPSHOT-b19adec_linux_arm64.tar.gz
    • archiving                                      name=snapshot\binny_0.13.2-SNAPSHOT-b19adec_darwin_arm64.tar.gz
    • archiving                                      name=snapshot\binny_0.13.2-SNAPSHOT-b19adec_darwin_amd64.tar.gz
    • archiving                                      name=snapshot\binny_0.13.2-SNAPSHOT-b19adec_linux_riscv64.tar.gz
    • archiving                                      name=snapshot\binny_0.13.2-SNAPSHOT-b19adec_windows_amd64.zip
  • software bill of materials
    • cataloging                                     cmd=../.tool/syft sbom=binny_0.13.2-SNAPSHOT-b19adec_windows_amd64.spdx.json
    • cataloging                                     cmd=../.tool/syft sbom=binny_0.13.2-SNAPSHOT-b19adec_linux_arm64.spdx.json
    • cataloging                                     cmd=../.tool/syft sbom=binny_0.13.2-SNAPSHOT-b19adec_linux_amd64.spdx.json
    • cataloging                                     cmd=../.tool/syft sbom=binny_0.13.2-SNAPSHOT-b19adec_linux_riscv64.spdx.json
    • cataloging                                     cmd=../.tool/syft sbom=binny_0.13.2-SNAPSHOT-b19adec_darwin_arm64.spdx.json
    • cataloging                                     cmd=../.tool/syft sbom=binny_0.13.2-SNAPSHOT-b19adec_darwin_amd64.spdx.json
  • calculating checksums
  • writing artifacts metadata
  • you are using deprecated options, check the output above for details
  • release succeeded after 1m33s
  • thanks for using GoReleaser!

And after extracting the .zip and copying in syft's .binny.yaml, using the windows build seems to work:

C:\Users\kzantow\Downloads\binny_0.13.2-SNAPSHOT-b19adec_windows_amd64>dir
07/29/2026  02:11 PM    <DIR>          .
07/29/2026  02:11 PM    <DIR>          ..
07/28/2026  01:54 PM               945 .binny.yaml
07/29/2026  12:05 PM        23,868,416 binny.exe
06/14/2024  05:42 PM            11,558 LICENSE
07/29/2026  02:06 PM            16,882 README.md
               4 File(s)     23,897,801 bytes
               2 Dir(s)  286,100,111,360 bytes free

C:\Users\kzantow\Downloads\binny_0.13.2-SNAPSHOT-b19adec_windows_amd64>binny.exe install

C:\Users\kzantow\Downloads\binny_0.13.2-SNAPSHOT-b19adec_windows_amd64>dir
07/29/2026  02:12 PM    <DIR>          .
07/29/2026  02:12 PM    <DIR>          ..
07/28/2026  01:54 PM               945 .binny.yaml
07/29/2026  02:12 PM    <DIR>          .tool
07/29/2026  12:05 PM        23,868,416 binny.exe
06/14/2024  05:42 PM            11,558 LICENSE
07/29/2026  02:06 PM            16,882 README.md
               4 File(s)     23,897,801 bytes
               3 Dir(s)  286,950,313,984 bytes free

C:\Users\kzantow\Downloads\binny_0.13.2-SNAPSHOT-b19adec_windows_amd64>dir .tool
07/29/2026  02:12 PM    <DIR>          .
07/29/2026  02:12 PM    <DIR>          ..
07/29/2026  02:12 PM               760 .binny.state.json
07/29/2026  02:12 PM        12,280,832 oras.exe
07/29/2026  02:12 PM        10,039,296 yajsv.windows.amd64.exe
07/29/2026  02:12 PM        14,235,136 yq_windows_amd64.exe
               4 File(s)     36,556,024 bytes
               2 Dir(s)  286,950,313,984 bytes free

C:\Users\kzantow\Downloads\binny_0.13.2-SNAPSHOT-b19adec_windows_amd64>binny run oras --help
Usage:
  oras [command]

Available Commands:
  attach      Attach files to an existing artifact
  backup      [Experimental] Back up artifacts from a registry into an OCI image layout
  blob        Blob operations
  completion  Generate the autocompletion script for the specified shell
  cp          Copy artifacts from one target to another
  discover    [Preview] Discover referrers of a manifest in a registry or an OCI image layout
  help        Help about any command
  login       Log in to a remote registry
  logout      Log out from a remote registry
  manifest    Manifest operations
  pull        Pull files from a registry or an OCI image layout
  push        Push files to a registry or an OCI image layout
  repo        Repository operations
  resolve     [Preview] Resolves digest of the target artifact
  restore     [Experimental] Restore artifacts to a registry from an OCI image layout
  tag         Tag a manifest in a registry or an OCI image layout
  version     Show the oras version information

Flags:
  -h, --help   help for oras

Use "oras [command] --help" for more information about a command.