ci: test and run the binary on arm64; arm64-first builds

.github/workflows/ci.yml

@@ -78,3 +78,34 @@ jobs:
       # there is one less third party in the chain.
       - name: actionlint
         run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+
+  # The same code on arm64, natively: release.go publishes darwin/arm64 and
+  # linux/arm64 binaries, and they are cross-compiled on amd64, so without this job
+  # neither the tests nor the binary would ever run on arm64. GitHub-hosted, free for
+  # public repositories: ubuntu-24.04-arm is Linux on arm64, macos-latest Apple
+  # Silicon. Only what depends on the architecture runs here; the other gates are
+  # the same everywhere and run once, in build.
+  arm64:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04-arm, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: '1.26'
+          check-latest: true
+
+      - name: go test
+        run: go test ./... -race
+
+      - name: run the binary
+        run: |
+          go build -trimpath -o awless-ro .
+          echo "built for $(go env GOOS)/$(go env GOARCH) on $(uname -sm)"
+          ./awless-ro version
+          ./awless-ro --help > /dev/null

.github/workflows/release.yml

@@ -13,7 +13,41 @@ permissions:
   contents: read
 
 jobs:
+  # The same code on arm64, natively: release.go publishes darwin/arm64 and
+  # linux/arm64 binaries, and they are cross-compiled on amd64, so without this job
+  # neither the tests nor the binary would ever run on arm64. GitHub-hosted, free for
+  # public repositories: ubuntu-24.04-arm is Linux on arm64, macos-latest Apple
+  # Silicon. Only what depends on the architecture runs here; the other gates are
+  # the same everywhere and run once, in release.
+  arm64:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04-arm, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: '1.26'
+          check-latest: true
+
+      - name: go test
+        run: go test ./... -race
+
+      - name: run the binary
+        run: |
+          go build -trimpath -o awless-ro .
+          echo "built for $(go env GOOS)/$(go env GOARCH) on $(uname -sm)"
+          ./awless-ro version
+          ./awless-ro --help > /dev/null
+
   release:
+    # arm64 artefacts are published only once their tests and binary have run on
+    # arm64.
+    needs: arm64
     runs-on: ubuntu-latest
     permissions:
       # To create the release and attach the artefacts. Nothing else.

CHANGELOG.md

@@ -18,6 +18,10 @@
   order in every format, instead of a different one on each read of the local graph.
 - The MFA code prompt, the first-run region prompt and `config set`'s value prompt
   are written to stderr.
+- `make build` builds for arm64 unless `GOARCH` says otherwise; `release.go` and the
+  README's install section list the arm64 archives first.
+- CI and the release workflow also run the tests and the binary on arm64, natively,
+  on GitHub's Linux arm64 and Apple Silicon runners.
 
 ### Fixed
 

CONTRIBUTING.md

@@ -47,6 +47,14 @@ go mod verify
 go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...
 ```
 
+### Where CI runs
+
+On GitHub-hosted runners only. `build` runs every gate above on `ubuntu-latest`;
+`arm64` runs the tests (with `-race`) and the built binary natively on
+`ubuntu-24.04-arm` and `macos-latest` (Apple Silicon), because the arm64 release
+artefacts are cross-compiled and would otherwise never be executed before they ship.
+The Release workflow runs the same `arm64` job before it publishes anything.
+
 ## Dependencies and the supply chain
 
 This project inherited its dependency list from a repository abandoned in 2018. One

Makefile

@@ -6,6 +6,13 @@ generate:
 	@echo "Generating commands code: runtime, doc, etc."
 	@go generate gen/aws/generators/main.go
 
+# arm64 by default: Apple Silicon and Graviton are the machines this is built for.
+# Override for anything else, e.g. `make build GOARCH=amd64`, or with GOARCH in the
+# environment. Only the binary is cross-built: make would otherwise export GOARCH to
+# every recipe, and generate and test have to run on the host.
+GOARCH ?= arm64
+unexport GOARCH
+
 build: generate test
-	@echo "Building application binary"
-	@go build -trimpath -o awless-ro
+	@echo "Building application binary for $$(go env GOOS)/$(GOARCH)"
+	@GOARCH=$(GOARCH) go build -trimpath -o awless-ro

README.md

@@ -241,6 +241,14 @@ go install github.com/theazz/awless-ro@latest
 Or download a binary from
 [releases](https://github.com/theazz/awless-ro/releases) and verify it:
 
+| Platform | Archive |
+|---|---|
+| macOS, Apple Silicon | `awless-ro-darwin-arm64.tar.gz` |
+| Linux, arm64 (Graviton and other 64-bit ARM) | `awless-ro-linux-arm64.tar.gz` |
+| macOS, Intel | `awless-ro-darwin-amd64.tar.gz` |
+| Linux, x86-64 | `awless-ro-linux-amd64.tar.gz` |
+| Windows, x86-64 | `awless-ro-windows-amd64.zip` |
+
 ```sh
 shasum -a 256 -c SHA256SUMS --ignore-missing
 ```
@@ -252,6 +260,9 @@ git clone https://github.com/theazz/awless-ro && cd awless-ro
 go build -o awless-ro .
 ```
 
+`make build` builds for arm64 by default; `make build GOARCH=amd64` for an Intel
+machine.
+
 Requires Go 1.26. No configuration needed if you already use the AWS CLI: existing
 `~/.aws/{credentials,config}` profiles are picked up, and anything missing is
 prompted for on first run. With no profile chosen, credentials in

release.go

@@ -46,10 +46,12 @@ var (
 )
 
 // 386 was dropped and arm64 added: Apple Silicon and Graviton are the platforms
-// that matter now, and 32-bit x86 has not been a realistic target for years.
+// that matter now, and 32-bit x86 has not been a realistic target for years. arm64
+// is listed first, as the default build (see the Makefile); the order is for the
+// reader only, the builds run concurrently and the checksums are sorted.
 var builds = map[string][]string{
-	"darwin":  {"amd64", "arm64"},
-	"linux":   {"amd64", "arm64"},
+	"darwin":  {"arm64", "amd64"},
+	"linux":   {"arm64", "amd64"},
 	"windows": {"amd64"},
 }