.goreleaser.yml

# ------------------------------------------------------------------------
# SPDX-FileCopyrightText: Copyright © 2024 bomctl authors
# SPDX-FileName: .goreleaser.yml
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: Apache-2.0
# ------------------------------------------------------------------------
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ------------------------------------------------------------------------
---
# yaml-language-server: $schema=https://goreleaser.com/static/schema.json

project_name: bomctl

env:
  - CGO_ENABLED=0
  - COSIGN_YES=true
  - GO111MODULE=on

before:
  hooks:
    - go mod tidy

brews:
  - name: "{{ .ProjectName }}"
    repository:
      owner: bomctl
      name: homebrew-bomctl
      branch: "{{ .ProjectName }}-{{ .Tag }}"
      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
      pull_request:
        enabled: true
        base:
          branch: main
          owner: bomctl
          name: homebrew-bomctl
    commit_msg_template: "build(release): upgrade {{ .ProjectName }} to {{ .Tag }}"
    homepage: https://github.com/bomctl/bomctl
    description: Format agnostic SBOM tooling
    license: Apache License 2.0

  # NOTE: Using .Version instead of .Tag here because homebrew can't handle versions with a 'v'
  - name: "{{ .ProjectName }}@{{ .Version }}"
    repository:
      owner: bomctl
      name: homebrew-bomctl
      branch: "{{ .ProjectName }}-{{ .Tag }}"
      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
      pull_request:
        enabled: true
        base:
          branch: main
          owner: bomctl
          name: homebrew-bomctl
    commit_msg_template: "build(release): {{ .ProjectName }}@{{ .Tag }}"
    homepage: https://github.com/bomctl/bomctl
    description: Format agnostic SBOM tooling
    license: Apache License 2.0

gomod:
  mod: mod
  proxy: true

builds:
  - binary: "{{.ProjectName}}"
    mod_timestamp: "{{.CommitTimestamp}}"
    flags: [-trimpath]
    goos: [linux, darwin, windows]
    goarch: [amd64, arm64]
    ldflags: -s -w
      -X=github.com/bomctl/bomctl/cmd.VersionMajor={{.Major}}
      -X=github.com/bomctl/bomctl/cmd.VersionMinor={{.Minor}}
      -X=github.com/bomctl/bomctl/cmd.VersionPatch={{.Patch}}
      -X=github.com/bomctl/bomctl/cmd.VersionPre={{with .Prerelease}}-{{.}}{{end}}
      -X=github.com/bomctl/bomctl/cmd.BuildDate={{.Date}}

dockers:
  - image_templates:
      - bomctl/bomctl:v{{ .Version }}-amd64
      - bomctl/bomctl:v{{ .Major }}-amd64
      - bomctl/bomctl:v{{ .Major }}.{{ .Minor }}-amd64
    dockerfile: Dockerfile
    use: buildx
    build_flag_templates:
      - --platform=linux/amd64
      - --label=org.opencontainers.image.title={{ .ProjectName }}
      - --label=org.opencontainers.image.url=https://github.com/bomctl/bomctl
      - --label=org.opencontainers.image.source=https://github.com/bomctl/bomctl
      - --label=org.opencontainers.image.version=v{{ .Version }}
      - --label=org.opencontainers.image.revision={{ .FullCommit }}
      - --label=org.opencontainers.image.licenses=Apache-2.0

  - image_templates:
      - bomctl/bomctl:v{{ .Version }}-arm64v8
      - bomctl/bomctl:v{{ .Major }}-arm64v8
      - bomctl/bomctl:v{{ .Major }}.{{ .Minor }}-arm64v8
    goarch: arm64
    dockerfile: Dockerfile
    use: buildx
    build_flag_templates:
      - --platform=linux/arm64/v8
      - --label=org.opencontainers.image.title={{ .ProjectName }}
      - --label=org.opencontainers.image.url=https://github.com/bomctl/bomctl
      - --label=org.opencontainers.image.source=https://github.com/bomctl/bomctl
      - --label=org.opencontainers.image.version=v{{ .Version }}
      - --label=org.opencontainers.image.revision={{ .FullCommit }}
      - --label=org.opencontainers.image.licenses=Apache-2.0

docker_manifests:
  - name_template: bomctl/bomctl:v{{ .Version }}
    image_templates:
      - bomctl/bomctl:v{{ .Version }}-amd64
      - bomctl/bomctl:v{{ .Version }}-arm64v8
  - name_template: bomctl/bomctl:v{{ .Major }}
    image_templates:
      - bomctl/bomctl:v{{ .Major }}-amd64
      - bomctl/bomctl:v{{ .Major }}-arm64v8
  - name_template: bomctl/bomctl:v{{ .Major }}.{{ .Minor }}
    image_templates:
      - bomctl/bomctl:v{{ .Major }}.{{ .Minor }}-amd64
      - bomctl/bomctl:v{{ .Major }}.{{ .Minor }}-arm64v8
  - name_template: bomctl/bomctl:latest
    image_templates:
      - bomctl/bomctl:v{{ .Version }}-amd64
      - bomctl/bomctl:v{{ .Version }}-arm64v8

sboms:
  - id: generate-cyclonedx
    artifacts: archive
    documents: [$artifact.cdx.json]
    cmd: ../.github/scripts/sbom-generation.sh
    args: [$artifact, cyclonedx, $document]

  - id: generate-spdx
    artifacts: archive
    documents: [$artifact.spdx.json]
    cmd: ../.github/scripts/sbom-generation.sh
    args: [$artifact, spdx, $document]

signs:
  - id: checksum-keyless-signing
    signature: ${artifact}-keyless.sig
    certificate: ${artifact}-keyless.pem
    cmd: cosign
    args: [sign-blob, --output-signature=$signature, --output-certificate=$certificate, $artifact]
    artifacts: checksum

  - id: binary-keyless-signing
    signature: ${artifact}-keyless.sig
    certificate: ${artifact}-keyless.pem
    cmd: cosign
    args: [sign-blob, --output-signature=$signature, --output-certificate=$certificate, $artifact]
    artifacts: binary

  - id: package-keyless-signing
    signature: ${artifact}-keyless.sig
    certificate: ${artifact}-keyless.pem
    cmd: cosign
    args: [sign-blob, --output-signature=$signature, --output-certificate=$certificate, $artifact]
    artifacts: package

docker_signs:
  - artifacts: all
    args: [sign, $artifact]

nfpms:
  - license: Apache License 2.0
    maintainer: bomctl authors
    homepage: https://github.com/bomctl/bomctl
    description: Simpler Software Bill of Materials management
    formats: [apk, deb, rpm]

archives:
  - strip_binary_directory: true
    format_overrides:
      - goos: windows
        format: zip

snapshot:
  name_template: SNAPSHOT-{{.ShortCommit}}

changelog:
  disable: false
  use: github
  sort: asc
  abbrev: -1
  groups:
    - title: 🆕 New features
      regexp: ^.*?feat(\([[:word:]]+\))??!?:.+$
      order: 0

    - title: 🐞 Bug fixes
      regexp: ^.*?(bug|fix)(\([[:word:]]+\))??!?:.+$
      order: 1

    - title: 📘 Documentation
      regexp: ^.*?docs(\([[:word:]]+\))??!?:.+$
      order: 2

    - title: 📝 Other changes
      regexp: ^.*?(refactor|perf|test)(\([[:word:]]+\))??!?:.+$
      order: 999

  filters:
    include:
      - ^.*?(feat|bug|fix|docs|refactor|perf|test)(\([[:word:]]+\))??!?:.+$

release:
  prerelease: auto
  draft: true # allow for manual edits
  github:
    owner: bomctl
    name: bomctl