test that released binaries are reproducible

.github/workflows/release.yml

@@ -43,10 +43,32 @@ jobs:
       - run: |
           REPO="${{ github.repository }}"
           REPO_NAME="${REPO#*/}"
-          ORIG_BIN="dist/${REPO_NAME}_linux_amd64_v1/${REPO_NAME}"
+          cp dist/${REPO_NAME}_linux_amd64_v1/${REPO_NAME}" released-binary
 
+      - uses: actions/upload-artifact@v3
+        with:
+          name: released-binary
+          path: ./released-binary
+
+  reproduce-binary:
+    runs-on: ubuntu-latest
+    needs: release-binary
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ env.GO_VERSION }}.x
+          check-latest: true
+          cache: true
+
+      - uses: actions/download-artifact@v3
+        with:
+          name: released-binary
+
+      - run: |
           go install github.com/capnspacehook/gorepro@latest
-          gorepro -b=-buildmode=pie -no-go-gc $ORIG_BIN
+          gorepro -b=-buildmode=pie -no-go-gc released-binary
 
   release-image:
     runs-on: ubuntu-latest