build: package Windows SILO archives as ZIP

Use ZIP for Windows amd64 and arm64. Validate the platform archive matrix, executable names, documentation, SBOMs and checksum coverage in the release pipeline.

Validated with local GoReleaser snapshots, six SPDX SBOMs and packaging regression checks.

Signed-off-by: Feng Ruohang <rh@vonng.com>

.github/goreleaser.yml

@@ -27,6 +27,10 @@ archives:
     ids:
       - silo
     name_template: "silo_{{ .Env.PKG_VERSION }}_{{ .Os }}_{{ .Arch }}"
+    formats: ["tar.gz"]
+    format_overrides:
+      - goos: windows
+        formats: ["zip"]
     # Explicit so the license materials cannot silently drop out of the
     # binary archives: GoReleaser's default file globs would miss NOTICE.
     # CREDITS stays out deliberately -- at 1.8MB it would dominate the

.github/workflows/test-release.yml

@@ -120,13 +120,34 @@ jobs:
           LDFLAGS: ${{ env.LDFLAGS }}
           PKG_VERSION: ${{ env.PKG_VERSION }}
 
-      - name: Verify archive SBOM and checksum coverage
+      - name: Verify archive formats, documentation, SBOMs, and checksums
         run: |
           set -euo pipefail
-          mapfile -t archives < <(find dist -maxdepth 1 -type f -name 'silo_*.tar.gz' | sort)
-          mapfile -t sboms < <(find dist -maxdepth 1 -type f -name 'silo_*.tar.gz.sbom.json' | sort)
+          mapfile -t archives < <(find dist -maxdepth 1 -type f \( -name 'silo_*.tar.gz' -o -name 'silo_*.zip' \) | sort)
+          mapfile -t sboms < <(find dist -maxdepth 1 -type f \( -name 'silo_*.tar.gz.sbom.json' -o -name 'silo_*.zip.sbom.json' \) | sort)
           test "${#archives[@]}" -eq 6
           test "${#sboms[@]}" -eq 6
+          for os in linux darwin windows; do
+            format=tar.gz
+            binary=silo
+            if [ "${os}" = windows ]; then
+              format=zip
+              binary=silo.exe
+            fi
+            for arch in amd64 arm64; do
+              archive="dist/silo_${PKG_VERSION}_${os}_${arch}.${format}"
+              test -s "${archive}"
+              jq -e '.spdxVersion | startswith("SPDX-")' "${archive}.sbom.json" >/dev/null
+              if [ "${format}" = zip ]; then
+                listing="$(unzip -Z1 "${archive}")"
+              else
+                listing="$(tar -tzf "${archive}")"
+              fi
+              for member in "${binary}" LICENSE NOTICE README.md; do
+                grep -Fx "${member}" <<< "${listing}"
+              done
+            done
+          done
           manifest="dist/silo_${PKG_VERSION}_checksums.txt"
           test -s "${manifest}"
           (