.goreleaser.yaml

env:
  - CGO_ENABLED=1
  - COSIGN_YES=true

before:
  hooks:
    - go mod tidy
    - go mod verify

builds:
  - id: "darwin-amd64"
    binary: "{{ .ProjectName }}"
    main: ./cmd/{{ .ProjectName }}
    goarch:
      - amd64
    goos:
      - darwin
    env:
      - CC=o64-clang
      - CXX=o64-clang++
    flags:
      - -trimpath
      - -pgo={{ .Env.PGO_FILE }}
    ldflags:
      - -s -w -X github.com/teler-sh/{{ .ProjectName }}/common.Version={{ .Version }}

  - id: "darwin-arm64"
    binary: "{{ .ProjectName }}"
    main: ./cmd/{{ .ProjectName }}
    goarch:
      - arm64
    goos:
      - darwin
    env:
      - CC=oa64-clang
      - CXX=oa64-clang++
    flags:
      - -trimpath
      - -pgo={{ .Env.PGO_FILE }}
    ldflags:
      - -s -w -X github.com/teler-sh/{{ .ProjectName }}/common.Version={{ .Version }}

  - id: "linux-amd64"
    binary: "{{ .ProjectName }}"
    main: ./cmd/{{ .ProjectName }}
    env:
      - CC=x86_64-linux-gnu-gcc
      - CXX=x86_64-linux-gnu-g++
    goarch:
      - amd64
    goos:
      - linux
    flags:
      - -trimpath
      - -pgo={{ .Env.PGO_FILE }}
    ldflags:
      - -s -w -X github.com/teler-sh/{{ .ProjectName }}/common.Version={{ .Version }}

  - id: "linux-arm64"
    binary: "{{ .ProjectName }}"
    main: ./cmd/{{ .ProjectName }}
    goarch:
      - arm64
    goos:
      - linux
    env:
      - CC=aarch64-linux-gnu-gcc
      - CXX=aarch64-linux-gnu-g++
    flags:
      - -trimpath
      - -pgo={{ .Env.PGO_FILE }}
    ldflags:
      - -s -w -X github.com/teler-sh/{{ .ProjectName }}/common.Version={{ .Version }}

  - id: "windows-amd64"
    binary: "{{ .ProjectName }}"
    main: ./cmd/{{ .ProjectName }}
    goarch:
      - amd64
    goos:
      - windows
    env:
      - CC=x86_64-w64-mingw32-gcc
      - CXX=x86_64-w64-mingw32-g++
    flags:
      - -trimpath
      - -pgo={{ .Env.PGO_FILE }}
      - -buildmode=exe
    ldflags:
      - -s -w -X github.com/teler-sh/{{ .ProjectName }}/common.Version={{ .Version }}

archives:
  - id: build
    builds:
      - "darwin-amd64"
      - "darwin-arm64"
      - "linux-amd64"
      - "linux-arm64"
      - "windows-amd64"
    name_template: >-
      {{- .ProjectName }}_{{- .Tag }}-
      {{- .Os }}_
      {{- if eq .Arch "amd64" }}x86_64
      {{- else if eq .Arch "386" }}i386
      {{- else }}{{ .Arch }}{{ end }}
    format: binary

signs:
  - cmd: cosign
    stdin: "{{ .Env.COSIGN_PASSWORD }}"
    args:
      - "sign-blob"
      - "--key"
      - "{{ .Env.COSIGN_KEY_PREFIX }}.key"
      - "--output-signature"
      - "${signature}"
      - "${artifact}"
    artifacts: binary

sboms:
  - artifacts: binary
    documents:
      - >-
        {{- .ProjectName }}_{{- .Tag }}-
        {{- .Os }}_
        {{- if eq .Arch "amd64" }}x86_64
        {{- else if eq .Arch "386" }}i386
        {{- else }}{{ .Arch }}{{ end }}.sbom

checksum:
  name_template: "checksums-{{ .ProjectName }}_{{ .Tag }}.txt"
snapshot:
  name_template: "{{ .Tag }}-{{ .ShortCommit }}"

dockers:
  - image_templates:
      - "ghcr.io/teler-sh/{{ .ProjectName }}:{{ .Tag }}"
      - "ghcr.io/teler-sh/{{ .ProjectName }}:v{{ .Major }}.{{ .Minor }}"
      - "ghcr.io/teler-sh/{{ .ProjectName }}:v{{ .Major }}"
      - "ghcr.io/teler-sh/{{ .ProjectName }}:latest"
    dockerfile: Dockerfile.goreleaser
    use: docker
    build_flag_templates:
      - "--pull"
      - "--label=org.opencontainers.image.authors=\"Dwi Siswanto <me@dw1.io>\""
      - "--label=org.opencontainers.image.created={{ .Date }}"
      - "--label=org.opencontainers.image.description=\"teler Proxy enabling seamless integration with teler WAF to protect locally running web service against a variety of web-based attacks\""
      - "--label=org.opencontainers.image.licenses=Apache-2.0"
      - "--label=org.opencontainers.image.ref.name={{ .Tag }}"
      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
      - "--label=org.opencontainers.image.title={{ .ProjectName }}"
      - "--label=org.opencontainers.image.url=https://github.com/teler-sh/{{ .ProjectName }}"
      - "--label=org.opencontainers.image.version={{ .Version }}"

docker_signs:
  - cmd: cosign
    stdin: "{{ .Env.COSIGN_PASSWORD }}"
    args:
      - "sign"
      - "--key"
      - "{{ .Env.COSIGN_KEY_PREFIX }}.key"
      - "--upload=false"
      - "${artifact}"
    artifacts: images
    output: true

changelog:
  sort: asc
  filters:
    exclude:
      - "^build"
      - "^chore"
      - "^ci"
      - "^docs"
      - "^refactor"
      - "^test"
      - Merge pull request
      - Merge branch

release:
  draft: true
  prerelease: auto
  footer: |
    ## Verify

    > [!IMPORTANT]
    > It is strongly recommended to verify the integrity and security of the release assets before executing them. This helps mitigate potential risks associated with running unverified files.

    First, verify the file using checksums.

    ```bash
    sha256sum --check --ignore-missing checksums-{{ .ProjectName }}_{{ .Tag }}.txt
    ```

    Then, ensure the authenticity of the release asset with [Cosign](https://github.com/sigstore/cosign):

    ```bash
    cosign verify-blob --key release-{{ .ProjectName }}_{{ .Tag }}.pub --signature {{ .ProjectName }}_{{ .Tag }}-OS_ARCH.sig {{ .ProjectName }}_{{ .Tag }}-OS_ARCH
    ```
  name_template: "{{ .Tag }}"
  extra_files:
    - glob: "{{ .Env.COSIGN_KEY_PREFIX }}.pub"
    - glob: "teler-waf.conf.example.*"