From 4af0e1ff00b154d6d57b840770ea572047308691 Mon Sep 17 00:00:00 2001
From: Manuel de Brito Fontes <aledbf@gmail.com>
Date: Sun, 20 Sep 2026 23:18:45 -0300
Subject: [PATCH] fix(release): ignore BuildKit configs written into the
 checkout

The release job's useblacksmith/setup-docker-builder step writes its
BuildKit daemon config with a relative path, so buildkitd.toml lands in
the repository checkout. GoReleaser validates a clean tree before
releasing and failed with "git is in a dirty state" on the untracked
file, aborting the release.

Ignore buildkitd.toml and the fallback builder's
docker-container-buildkitd.toml at the repo root. Ignored files do not
count as dirty, and the daemon keeps the config it was started with.

TestReleaseBuilderConfigsAreGitIgnored checks both paths with
`git check-ignore --no-index`, without touching the working tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .gitignore                            |  6 ++++
 internal/cli/release_workflow_test.go | 46 +++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 internal/cli/release_workflow_test.go

diff --git a/.gitignore b/.gitignore
index 312f39f..9d2022e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,9 @@ coverage.xml
 *.test
 .claude/
 .task/
+
+# BuildKit daemon configs that useblacksmith/setup-docker-builder writes into the
+# job's working directory (the repo checkout) in the release workflow. Left
+# untracked they make the tree dirty and GoReleaser refuses to release.
+/buildkitd.toml
+/docker-container-buildkitd.toml
diff --git a/internal/cli/release_workflow_test.go b/internal/cli/release_workflow_test.go
new file mode 100644
index 0000000..05ce97d
--- /dev/null
+++ b/internal/cli/release_workflow_test.go
@@ -0,0 +1,46 @@
+package cli
+
+import (
+	"errors"
+	"os/exec"
+	"path/filepath"
+	"testing"
+)
+
+// TestReleaseBuilderConfigsAreGitIgnored guards the release job against a dirty
+// tree. useblacksmith/setup-docker-builder writes its BuildKit daemon config with
+// a relative path, so it lands in the job's working directory — the repository
+// checkout. GoReleaser validates that the tree is clean before releasing, and an
+// untracked buildkitd.toml made `goreleaser release` fail with "git is in a dirty
+// state". Ignored files do not count as dirty, so the configs must stay ignored.
+//
+// `git check-ignore --no-index` evaluates the ignore rules for a path without the
+// file existing, so the test never touches the working tree.
+func TestReleaseBuilderConfigsAreGitIgnored(t *testing.T) {
+	gitPath, err := exec.LookPath("git")
+	if err != nil {
+		t.Skip("git not available")
+	}
+	repoRoot, err := filepath.Abs(filepath.Join("..", ".."))
+	if err != nil {
+		t.Fatalf("resolve repo root: %v", err)
+	}
+
+	for _, name := range []string{
+		"buildkitd.toml",                  // setup_builder.ts: writeTomlConfig("buildkitd.toml", ...)
+		"docker-container-buildkitd.toml", // setup_builder.ts: the docker-container fallback builder
+	} {
+		cmd := exec.Command(gitPath, "check-ignore", "--quiet", "--no-index", name)
+		cmd.Dir = repoRoot
+		err := cmd.Run()
+		var exitErr *exec.ExitError
+		switch {
+		case err == nil:
+			// Exit 0: the path is ignored.
+		case errors.As(err, &exitErr) && exitErr.ExitCode() == 1:
+			t.Errorf("%s is not git-ignored: the release job's builder writes it into the checkout and GoReleaser then fails on a dirty tree", name)
+		default:
+			t.Fatalf("git check-ignore %s: %v", name, err)
+		}
+	}
+}