release.yaml

name: release
on:
  push:
    branches:
    - main
permissions: {}
jobs:
  release-tag:
    permissions:
      # create tag
      contents: write
    runs-on: ubuntu-latest
    outputs:
      new-tag: ${{ steps.ccv.outputs.new-tag }}
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0
    - name: Bump tag if necessary
      id: ccv
      uses: smlx/ccv@d3de774e9b607b079940a7a86952f44643743336 # v0.9.0
  release-build:
    permissions:
      # create release
      contents: write
      # push docker images to registry
      packages: write
      # use OIDC token for signing
      id-token: write
      # required by attest-build-provenance
      attestations: write
    needs: release-tag
    if: needs.release-tag.outputs.new-tag == 'true'
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0
    - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
      with:
        go-version: stable
    - name: Login to GHCR
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Set up environment
      run: echo "GOVERSION=$(go version)" >> "$GITHUB_ENV"
    - uses: advanced-security/sbom-generator-action@375dee8e6144d9fd0ec1f5667b4f6fb4faacefed # v0.0.1
      id: sbom
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Move sbom to avoid dirty git
      run: mv "$GITHUB_SBOM_PATH" ./sbom.spdx.json
      env:
        GITHUB_SBOM_PATH: ${{ steps.sbom.outputs.fileName }}
    - uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
      id: goreleaser
      with:
        version: latest
        args: release --clean
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        GITHUB_SBOM_PATH: ./sbom.spdx.json
    # parse artifacts to the format required for image attestation
    - run: |
        echo "digest=$(echo "$ARTIFACTS" | jq -r '.[]|select(.type=="Docker Manifest")|select(.name|test(":v"))|.extra.Digest')" >> "$GITHUB_OUTPUT"
        echo "name=$(echo "$ARTIFACTS" | jq -r '.[]|select(.type=="Docker Manifest")|select(.name|test(":v"))|.name|split(":")[0]')" >> "$GITHUB_OUTPUT"
      id: image_metadata
      env:
        ARTIFACTS: ${{steps.goreleaser.outputs.artifacts}}
    # attest archives
    - uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
      with:
        subject-path: "dist/*.tar.gz"
    # attest images
    - uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
      with:
        subject-digest: ${{steps.image_metadata.outputs.digest}}
        subject-name: ${{steps.image_metadata.outputs.name}}
        push-to-registry: true