goreleaser.yml

name: goreleaser

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - next
      - alpha
      - beta
    tags:
      - "*"
  release:
    types:
      - published

permissions:
  contents: write
  packages: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        if: github.event_name == 'pull_request'
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.ref }}
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        if: github.event_name != 'pull_request'
        with:
          fetch-depth: 0
      - name: setup-go
        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5
        with:
          go-version: 1.23.x
      - uses: anchore/sbom-action/download-syft@55dc4ee22412511ee8c3142cbea40418e6cec693 # v0.17.8
      - name: setup qemu
        id: qemu
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3
      - name: setup docker buildx
        id: buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3
      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: install cosign
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3
      - name: install quill
        env:
          QUILL_VERSION: 0.4.1
        run: |
          curl -Lo /tmp/quill_${QUILL_VERSION}_linux_amd64.tar.gz https://github.com/anchore/quill/releases/download/v${QUILL_VERSION}/quill_${QUILL_VERSION}_linux_amd64.tar.gz
          tar -xvf /tmp/quill_${QUILL_VERSION}_linux_amd64.tar.gz -C /tmp
          mv /tmp/quill /usr/local/bin/quill
          chmod +x /usr/local/bin/quill
      - name: set goreleaser default args
        if: startsWith(github.ref, 'refs/tags/') == true
        run: |
          echo "GORELEASER_ARGS=" >> $GITHUB_ENV
      - name: set goreleaser args for branch
        if: startsWith(github.ref, 'refs/tags/') == false
        run: |
          echo "GORELEASER_ARGS=--snapshot" >> $GITHUB_ENV
      - name: set goreleaser args renovate
        if: startsWith(github.ref, 'refs/heads/renovate') == true
        run: |
          echo "GORELEASER_ARGS=--snapshot --skip publish --skip sign" >> $GITHUB_ENV
      - name: setup-quill
        uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2
        # Extra Safeguard - This ensures the secrets are only loaded on tag and a tag that the repo owner triggered
        if: startsWith(github.ref, 'refs/tags/') == true && github.actor == 'ekristen-dev[bot]'
        with:
          export-env: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          QUILL_NOTARY_KEY: ${{ secrets.OP_QUILL_NOTARY_KEY }}
          QUILL_NOTARY_KEY_ID: ${{ secrets.OP_QUILL_NOTARY_KEY_ID }}
          QUILL_NOTARY_ISSUER: ${{ secrets.OP_QUILL_NOTARY_ISSUER }}
          QUILL_SIGN_PASSWORD: ${{ secrets.OP_QUILL_SIGN_PASSWORD }}
          QUILL_SIGN_P12: ${{ secrets.OP_QUILL_SIGN_P12 }}
      - name: run goreleaser
        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6
        with:
          distribution: goreleaser
          version: latest
          args: release --clean ${{ env.GORELEASER_ARGS }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: push docker images (for branches)
        if: github.ref == 'refs/heads/main' || github.event.pull_request.base.ref == 'main'
        run: |
          docker images --format "{{.Repository}}:{{.Tag}}" | grep "${{ github.repository }}" | xargs -L1 docker push
      - name: upload artifacts
        if: github.event.pull_request.base.ref == 'main'
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: binaries
          path: releases/*.tar.gz