ci: build releases with -trimpath and check reproducibility

.github/workflows/reproducibility.yml

@@ -0,0 +1,41 @@
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions: {}
+
+jobs:
+  reproducibility:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: false
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
+        with:
+          version: v2.15.2
+          install-only: true
+      - name: Build the release artifact with goreleaser
+        run: goreleaser build --snapshot --clean --single-target -o /tmp/goreleaser-build
+
+      - name: Rebuild from source and compare digests
+        run: |
+          VERSION=$(jq -r .version dist/metadata.json)
+          COMMIT=$(jq -r .commit dist/metadata.json | cut -c1-7)
+          cp -a . /tmp/src-elsewhere
+          cd /tmp/src-elsewhere
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOAMD64=v1 \
+            go build -trimpath \
+              -ldflags="-s -w -X main.Version=$VERSION -X main.Commit=$COMMIT" \
+              -o /tmp/plain-build .
+          sha256sum /tmp/goreleaser-build /tmp/plain-build
+          cmp /tmp/goreleaser-build /tmp/plain-build \
+            && echo "Reproducible build confirmed"

.goreleaser.yaml

@@ -7,6 +7,8 @@ before:
 builds:
   - env:
       - CGO_ENABLED=0
+    flags:
+      - -trimpath
     ldflags:
       - -s -w
       - -X main.Version={{.Version}}