Add GoReleaser configuration for release automation (#21)

* Add GoReleaser configuration for release automation

Configure GoReleaser to build and release binaries for the registry server.
The configuration specifies the correct main package location at
./cmd/thv-registry-api and sets up multi-platform builds for Linux, macOS,
and Windows on amd64 and arm64 architectures.

This fixes the release workflow failure where GoReleaser couldn't locate
the main package because it was using default settings.

The configuration includes:
- Version/commit/builddate injection via ldflags
- Cosign signing for release artifacts
- SBOM generation for security compliance
- Archive generation with platform-specific formats
- Source code release

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

* Fix package path in ko config for container image builds

Correct the ldflags package path from github.com/stacklok/toolhive to
github.com/stacklok/toolhive-registry-server to ensure version metadata
is properly injected into container images.

This was caught during PR review when verifying that version/commit/builddate
are passed to container image builds.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

---------

Co-authored-by: Claude <[email protected]>

Author: jhrozek

.github/ko-ci.yml

@@ -3,7 +3,7 @@ builds:
     dir: ./cmd/thv-registry-api
     ldflags:
       - -s -w
-      - -X github.com/stacklok/toolhive/pkg/versions.Version={{.Env.VERSION}}
-      - -X github.com/stacklok/toolhive/pkg/versions.Commit={{.Env.COMMIT}}
-      - -X github.com/stacklok/toolhive/pkg/versions.BuildDate={{.Env.BUILD_DATE}}
-      - -X github.com/stacklok/toolhive/pkg/versions.BuildType=release
+      - -X github.com/stacklok/toolhive-registry-server/pkg/versions.Version={{.Env.VERSION}}
+      - -X github.com/stacklok/toolhive-registry-server/pkg/versions.Commit={{.Env.COMMIT}}
+      - -X github.com/stacklok/toolhive-registry-server/pkg/versions.BuildDate={{.Env.BUILD_DATE}}
+      - -X github.com/stacklok/toolhive-registry-server/pkg/versions.BuildType=release

.goreleaser.yaml

@@ -0,0 +1,60 @@
+# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
+project_name: toolhive-registry-server
+version: 2
+# This section defines the build matrix.
+builds:
+  - env:
+      - GO111MODULE=on
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+      - -tags=netgo
+    ldflags:
+      - "-s -w"
+      - "-X github.com/stacklok/toolhive-registry-server/pkg/versions.Version={{ .Env.VERSION }}"
+      - "-X github.com/stacklok/toolhive-registry-server/pkg/versions.Commit={{ .Env.COMMIT }}"
+      - "-X github.com/stacklok/toolhive-registry-server/pkg/versions.BuildDate={{ .Date }}"
+      - "-X github.com/stacklok/toolhive-registry-server/pkg/versions.BuildType=release"
+    goos:
+      - linux
+      - windows
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+    main: ./cmd/thv-registry-api
+    binary: thv-registry-api
+# This section defines the release format.
+archives:
+  - formats: [ 'tar.gz' ]
+    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    format_overrides:
+      - goos: windows
+        formats: [ 'zip' ]
+# This section defines whether we want to release the source code too.
+source:
+  enabled: true
+# This section defines how to generate the changelog
+changelog:
+  sort: asc
+  use: github
+# This section defines for which artifact types to generate SBOMs.
+sboms:
+  - artifacts: archive
+# This section defines the release policy.
+release:
+  github:
+    owner: stacklok
+    name: toolhive-registry-server
+# This section defines how and which artifacts we want to sign for the release.
+signs:
+  - cmd: cosign
+    args:
+      - "sign-blob"
+      - "--output-signature=${signature}"
+      - "--output-certificate=${certificate}"
+      - "${artifact}"
+      - "--yes" # needed on cosign 2.0.0+
+    artifacts: archive
+    output: true
+    certificate: '{{ trimsuffix (trimsuffix .Env.artifact ".zip") ".tar.gz" }}.pem'