Monitoring GoReleaser with Vigilmon

GoReleaser turns git tag && git push --tags into a fully automated release — cross-platform binaries, Docker images, checksums, Homebrew formulae, and GitHub releases, all in one run. But when a release pipeline spans Cosign signing, five package registries, and a Docker push, any single failure can silently block your release while CI reports green. Vigilmon keeps every layer of your GoReleaser setup observable — from the GoReleaser Pro server to artifact checksums and registry connectivity.

What You'll Set Up

• GoReleaser Pro server availability monitor (port 3000)
• Build pipeline health checks per OS/ARCH target
• Artifact signing and Cosign availability monitors
• Docker registry connectivity checks
• GitHub/GitLab release API health monitors
• Package registry publishing health (Homebrew, Scoop, npm, PyPI)
• Changelog generation and SBOM artifact health alerts

Prerequisites

• GoReleaser (open source CLI) or GoReleaser Pro with server mode enabled
• A CI/CD pipeline that runs goreleaser release
• A free Vigilmon account

Step 1: Monitor the GoReleaser Pro Server

GoReleaser Pro can run as a persistent server (default port 3000) that exposes a REST API for triggering and monitoring release jobs across a monorepo. If this server is unreachable, all programmatic release triggers fail silently.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter your GoReleaser Pro server health endpoint: http://your-goreleaser-server:3000/healthz (or the root / if no health path exists).
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Click Save.

If GoReleaser Pro exposes a metrics endpoint, add a second monitor targeting it to track active jobs and queue depth.

Step 2: Expose a Health Endpoint from Your Release Toolchain

If you run GoReleaser inside a sidecar service or webhook trigger (common in monorepo setups), expose a lightweight health route that Vigilmon can probe between releases:

package main

import (
    "encoding/json"
    "net/http"
    "time"
)

func healthHandler(w http.ResponseWriter, r *http.Request) {
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(map[string]interface{}{
        "status": "ok",
        "time":   time.Now().UTC(),
    })
}

func main() {
    http.HandleFunc("/healthz", healthHandler)
    http.ListenAndServe(":3000", nil)
}

Deploy this alongside your release service. Vigilmon probes /healthz every minute and alerts your on-call channel the moment the service stops responding.

Step 3: Monitor Build Pipeline Health per OS/ARCH

GoReleaser builds cross-platform binaries for every target in your .goreleaser.yaml. A toolchain issue on a single target (e.g., missing CC for linux/arm64 CGO builds) fails silently unless you parse CI logs.

Set up a Cron Heartbeat monitor to catch build failures:

1. In Vigilmon, click Add Monitor and select Cron Heartbeat.
2. Name it GoReleaser Build Heartbeat.
3. Set Expected ping interval to match your release cadence (e.g., 24h for daily releases, 1h for frequent deploys).
4. Copy the generated heartbeat URL.

In your GoReleaser CI step (GitHub Actions example):

- name: Run GoReleaser
  uses: goreleaser/goreleaser-action@v6
  with:
    args: release --clean
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}

- name: Ping Vigilmon on successful release
  if: success()
  run: curl -fsS "${{ secrets.VIGILMON_GORELEASER_HB_URL }}"

If the release fails for any target, the heartbeat ping never fires and Vigilmon alerts within your configured grace period.

Step 4: Monitor Artifact Signing Health (Cosign)

GoReleaser integrates with Cosign to sign release binaries and Docker images. Signing failures silently drop signatures from your release artifacts — a security regression that's invisible until a downstream consumer runs cosign verify.

Add a dedicated heartbeat for the signing step:

- name: Sign release artifacts
  run: |
    cosign sign-blob --key env://COSIGN_PRIVATE_KEY \
      dist/checksums.txt > dist/checksums.txt.sig
    echo "Signing complete"

- name: Ping Vigilmon signing heartbeat
  if: success()
  run: curl -fsS "${{ secrets.VIGILMON_SIGNING_HB_URL }}"

Set the expected interval slightly longer than your longest release pipeline run. If the signing step stalls or the key material becomes unavailable, Vigilmon fires an alert before your next signed release ships without signatures.

Step 5: Monitor Docker Registry Connectivity

GoReleaser pushes Docker images to one or more registries (Docker Hub, GHCR, ECR) during release. Registry authentication failures or push timeouts produce late-stage release failures after all binaries are already built.

Add a TCP monitor for each registry:

1. Click Add Monitor → TCP Port Check.
2. For Docker Hub: host registry-1.docker.io, port 443.
3. For GHCR: host ghcr.io, port 443.
4. Set Check interval to 2 minutes.
5. Repeat for ECR (<account>.dkr.ecr.<region>.amazonaws.com:443) or any private registry.

For push health specifically, add a heartbeat that fires only after a successful docker push:

- name: Push Docker image
  run: docker push myorg/myapp:${{ github.ref_name }}

- name: Ping Vigilmon Docker push heartbeat
  if: success()
  run: curl -fsS "${{ secrets.VIGILMON_DOCKER_HB_URL }}"

Step 6: Monitor GitHub/GitLab Release API Health

GoReleaser creates GitHub Releases and uploads artifact assets via the GitHub API. API rate limit exhaustion or token scope issues cause goreleaser release to fail at the upload stage — after the full build has completed.

Add an HTTP monitor for the GitHub API:

1. Add Monitor → HTTP / HTTPS.
2. URL: https://api.github.com (returns 200 with the API root).
3. Check interval: 5 minutes.
4. Expected status: 200.

For token health, add a CI step that checks rate limits before the release runs:

- name: Check GitHub API rate limit
  run: |
    remaining=$(curl -s -H "Authorization: token $GITHUB_TOKEN" \
      https://api.github.com/rate_limit | jq '.rate.remaining')
    echo "GitHub API requests remaining: $remaining"
    if [ "$remaining" -lt 100 ]; then
      echo "::warning::GitHub API rate limit low: $remaining remaining"
    fi
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Step 7: Monitor Package Registry Publishing

GoReleaser publishes to Homebrew tap repos, Scoop manifests, npm, PyPI, AUR, and more. Each registry has its own authentication token that can expire independently.

Add a heartbeat per registry that fires after a successful publish:

- name: Verify Homebrew formula pushed
  run: |
    git -C /tmp/homebrew-tap log --oneline -1
    curl -fsS "${{ secrets.VIGILMON_HOMEBREW_HB_URL }}"

- name: Verify Scoop manifest pushed
  run: curl -fsS "${{ secrets.VIGILMON_SCOOP_HB_URL }}"

Set each heartbeat interval to your release cadence plus a buffer. If a registry token expires silently, that heartbeat misses its window and Vigilmon alerts before users notice the stale package.

Step 8: Monitor Changelog and SBOM Generation

GoReleaser generates changelogs from git history and (optionally) creates Software Bill of Materials (SBOM) files using Syft. Config errors in changelog.filters silently produce empty changelogs, and Syft unavailability drops SBOMs from releases.

Add a post-release validation step:

- name: Validate changelog and SBOM artifacts
  run: |
    # Verify CHANGELOG.md was updated
    if [ ! -s dist/CHANGELOG.md ]; then
      echo "::error::Changelog file is empty or missing"
      exit 1
    fi
    # Verify SBOM exists if Syft is configured
    if goreleaser check | grep -q "sbom"; then
      ls dist/*.sbom.json || (echo "::error::SBOM missing" && exit 1)
    fi
    curl -fsS "${{ secrets.VIGILMON_SBOM_HB_URL }}"

Step 9: Configure Alerting

In Vigilmon, go to Alert Channels and configure notifications for your release pipeline:

• Slack or Microsoft Teams — post to your #releases channel for any monitor failure.
• PagerDuty or OpsGenie — page on-call for signing failures or Pro server downtime (these block all releases).
• Email — send a digest for package registry heartbeat misses (lower urgency, but track token expiry proactively).

Set alert thresholds:

• GoReleaser Pro server: alert after 1 failed check (immediate impact).
• Build/signing heartbeats: alert after missed window + 30 minutes (allow for slow CI queues).
• Registry TCP monitors: alert after 3 consecutive failures (transient network blips are common).

Conclusion

GoReleaser turns a complex, multi-step release process into a single command — but that compression hides a lot of failure surface: signing keys, registry tokens, API rate limits, and cross-compilation toolchains can all fail independently. With Vigilmon monitoring the GoReleaser Pro server, CI heartbeats for each pipeline stage, and TCP checks for every downstream registry, you catch release failures before users encounter missing packages, unsigned artifacts, or stale Homebrew formulae. Your release pipeline becomes as observable as your production services.