Use dummy binary and custom runners for fast iteration

- Build a trivial main.go instead of the full CLI for speed
- Use custom Windows runner (windows-server-latest-large)
- Add JFrog OIDC setup on both runners
- Add id-token: write permission for OIDC

Co-authored-by: Isaac

Author: pietern

.github/release-test/main.go

@@ -0,0 +1,7 @@
+package main
+
+import "fmt"
+
+func main() {
+	fmt.Println("release-test")
+}

.github/workflows/release-test.yml

@@ -9,12 +9,16 @@ on:
 
 jobs:
   # Build Unix (Linux/macOS) binaries in snapshot mode.
-  # Skips Docker images and GitHub release publishing.
+  # Uses a dummy binary for fast iteration on the workflow itself.
   goreleaser-unix:
     runs-on:
       group: databricks-deco-testing-runner-group
       labels: ubuntu-latest-deco
 
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout repository and submodules
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -35,7 +39,7 @@ jobs:
           go-version-file: go.mod
           cache-dependency-path: |
             go.sum
-            .goreleaser-unix.yaml
+            .goreleaser-test-unix.yaml
 
       - name: Configure Go module proxy via JFrog
         run: jf goc --repo-resolve=db-golang
@@ -47,7 +51,7 @@ jobs:
         uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
         with:
           version: ~> v2
-          args: release -f .goreleaser-unix.yaml --snapshot --skip docker
+          args: release -f .goreleaser-test-unix.yaml --snapshot
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -64,7 +68,13 @@ jobs:
   # Uses AzureSignTool with Azure Key Vault for code signing.
   goreleaser-windows:
     environment: sign
-    runs-on: windows-latest
+    runs-on:
+      group: databricks-protected-runner-group-large
+      labels: windows-server-latest-large
+
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - name: Checkout repository and submodules
@@ -73,13 +83,24 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Setup JFrog CLI with OIDC
+        uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5 # v4.9.1
+        env:
+          JF_URL: https://databricks.jfrog.io
+        with:
+          oidc-provider-name: github-actions
+
       - name: Setup Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: go.mod
           cache-dependency-path: |
             go.sum
-            .goreleaser-windows.yaml
+            .goreleaser-test-windows.yaml
+
+      - name: Configure Go module proxy via JFrog
+        shell: bash
+        run: jf goc --repo-resolve=db-golang
 
       - name: Hide snapshot tag to outsmart GoReleaser
         run: git tag -d snapshot || true
@@ -109,7 +130,7 @@ jobs:
         uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
         with:
           version: ~> v2
-          args: release -f .goreleaser-windows.yaml --snapshot
+          args: release -f .goreleaser-test-windows.yaml --snapshot
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           AZURE_TENANT_ID: ${{ secrets.DECO_SIGN_AZURE_TENANT_ID }}

.goreleaser-test-unix.yaml

@@ -0,0 +1,26 @@
+version: 2
+
+builds:
+  - main: ./.github/release-test
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+    goos:
+      - linux
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+    binary: databricks
+
+archives:
+  - formats: ["zip", "tar.gz"]
+    name_template: 'databricks_cli_{{ if not .IsSnapshot }}{{ .Version }}_{{ end }}{{ .Os }}_{{ .Arch }}'
+
+checksum:
+  name_template: 'databricks_cli_{{ .Version }}_SHA256SUMS_unix'
+  algorithm: sha256
+
+snapshot:
+  version_template: '{{ incpatch .Version }}-dev+{{ .ShortCommit }}'

.goreleaser-test-windows.yaml

@@ -0,0 +1,30 @@
+version: 2
+
+builds:
+  - id: cli
+    main: ./.github/release-test
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+    goos:
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    binary: databricks
+
+    hooks:
+      post:
+        - azuresigntool sign --azure-key-vault-url "https://deco-sign.vault.azure.net/" --azure-key-vault-client-id "{{ .Env.AZURE_CLIENT_ID }}" --azure-key-vault-client-secret "{{ .Env.AZURE_CLIENT_SECRET }}" --azure-key-vault-tenant-id "{{ .Env.AZURE_TENANT_ID }}" --azure-key-vault-certificate "deco-sign" --file-digest sha256 --timestamp-rfc3161 http://timestamp.digicert.com --timestamp-digest sha256 "{{ .Path }}"
+
+archives:
+  - formats: ["zip"]
+    name_template: 'databricks_cli_{{ if not .IsSnapshot }}{{ .Version }}_{{ end }}{{ .Os }}_{{ .Arch }}'
+
+checksum:
+  name_template: 'databricks_cli_{{ .Version }}_SHA256SUMS_windows'
+  algorithm: sha256
+
+snapshot:
+  version_template: '{{ incpatch .Version }}-dev+{{ .ShortCommit }}'