goreleaser.yml

# ------------------------------------------------------------------------
# SPDX-FileCopyrightText: Copyright © 2024 bomctl authors
# SPDX-FileName: .github/workflows/goreleaser.yml
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: Apache-2.0
# ------------------------------------------------------------------------
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ------------------------------------------------------------------------
---
name: goreleaser

on:
  push:
    branches: main
    tags: v*

permissions:
  contents: read

jobs:
  release:
    runs-on: ubuntu-latest

    permissions:
      contents: write # needed to write releases
      id-token: write # needed for cosign
      attestations: write # needed for attestations

    steps:
      - name: Checkout code
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Install Cosign
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
        with:
          cosign-release: v2.2.4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0

      - name: Install Syft
        uses: anchore/sbom-action/download-syft@b6a39da80722a2cb0ef5d197531764a89b5d48c3 # v0.15.8

      - name: Get GitHub App installation token
        uses: actions/create-github-app-token@7bfa3a4717ef143a604ee0a99d859b8886a96d00 # v1.9.3
        id: app-token
        with:
          app-id: ${{ vars.GORELEASER_BOT_APP_ID }}
          private-key: ${{ secrets.GORELEASER_BOT_RSA_PRIVATE_KEY }}
          owner: bomctl
          repositories: homebrew-bomctl

      - name: Login to Docker Hub
        if: startsWith(github.ref, 'refs/tags/')
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Pull base container image
        run: docker pull cgr.dev/chainguard/static:latest

      - name: Verify base container image
        run: cosign verify
          --certificate-oidc-issuer=https://token.actions.githubusercontent.com
          --certificate-identity=https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main
          cgr.dev/chainguard/static:latest

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
        with:
          distribution: goreleaser
          version: latest
          args: release --clean ${{ env.SNAPSHOT }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          SNAPSHOT: ${{ github.ref_type != 'tag' && '--snapshot' || '' }}

      - name: Attest Archives
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/attest-build-provenance@173725a1209d09b31f9d30a3890cf2757ebbff0d # v1.1.2
        with:
          subject-path: dist/*[.zrda][gipep][zpbk] # match .gz, zip, deb, apk

      - name: Attest Artifacts
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/attest-build-provenance@173725a1209d09b31f9d30a3890cf2757ebbff0d # v1.1.2
        with:
          subject-path: dist/bomctl*/* # match all binaries created

      - name: Archive production artifacts
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
          name: dist
          path: |
            dist
            !dist/syft-
          retention-days: 3