goreleaser.yml

name: goreleaser

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - next
    tags:
      - "*"
  release:
    types:
      - published

permissions:
  contents: write
  packages: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
        if: github.event_name == 'pull_request'
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.ref }}
      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
        if: github.event_name != 'pull_request'
        with:
          fetch-depth: 0
      - name: setup-go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5
        with:
          go-version: 1.22.x
      - uses: anchore/sbom-action/download-syft@1ca97d9028b51809cf6d3c934c3e160716e1b605 # v0.17.5
      - name: install cosign
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3
      - name: install quill
        env:
          QUILL_VERSION: 0.4.2
        run: |
          curl -Lo /tmp/quill_${QUILL_VERSION}_linux_amd64.tar.gz https://github.com/anchore/quill/releases/download/v${QUILL_VERSION}/quill_${QUILL_VERSION}_linux_amd64.tar.gz
          tar -xvf /tmp/quill_${QUILL_VERSION}_linux_amd64.tar.gz -C /tmp
          mv /tmp/quill /usr/local/bin/quill
          chmod +x /usr/local/bin/quill
      - name: set goreleaser default args
        if: startsWith(github.ref, 'refs/tags/') == true
        run: |
          echo "GORELEASER_ARGS=" >> $GITHUB_ENV
      - name: set goreleaser args for branch
        if: startsWith(github.ref, 'refs/tags/') == false
        run: |
          echo "GORELEASER_ARGS=--snapshot" >> $GITHUB_ENV
      - name: set goreleaser args renovate
        if: startsWith(github.ref, 'refs/heads/renovate') == true
        run: |
          echo "GORELEASER_ARGS=--snapshot --skip publish --skip sign" >> $GITHUB_ENV
      - name: setup-quill
        uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2
        if: startsWith(github.ref, 'refs/tags/') == true && (github.actor == github.repository_owner || github.actor == 'sans-sroc[bot]')
        with:
          export-env: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          QUILL_NOTARY_KEY: ${{ secrets.OP_QUILL_NOTARY_KEY }}
          QUILL_NOTARY_KEY_ID: ${{ secrets.OP_QUILL_NOTARY_KEY_ID }}
          QUILL_NOTARY_ISSUER: ${{ secrets.OP_QUILL_NOTARY_ISSUER }}
          QUILL_SIGN_PASSWORD: ${{ secrets.OP_QUILL_SIGN_PASSWORD }}
          QUILL_SIGN_P12: ${{ secrets.OP_QUILL_SIGN_P12 }}
      - name: run goreleaser
        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6
        with:
          distribution: goreleaser
          version: latest
          args: release --clean ${{ env.GORELEASER_ARGS }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: upload artifacts
        if: github.event.pull_request.base.ref == 'main'
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: binaries
          path: releases/*.tar.gz