1name: cut-release
2
3on:
4 push:
5 tags:
6 - "v*"
7
8concurrency: cut-release
9
10permissions: read-all
11
12jobs:
13 release:
14 permissions:
15 contents: write # needed to write releases
16 id-token: write # needed for keyless signing
17 packages: write # needed for pushing the images to ghcr.io
18 runs-on: ubuntu-latest
19 outputs:
20 hashes: ${{ steps.hash.outputs.hashes }}
21 tag_name: ${{ steps.tag.outputs.tag_name }}
22 steps:
23 - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
24
25 - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
26 with:
27 go-version-file: './go.mod'
28 check-latest: true
29
30 - uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
31 - uses: anchore/sbom-action/download-syft@b6a39da80722a2cb0ef5d197531764a89b5d48c3 # v0.15.8
32 - uses: imjasonh/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
33
34 - name: Set LDFLAGS
35 id: ldflags
36 run: |
37 source ./release/ldflags.sh
38 goflags=$(ldflags)
39 echo "GO_FLAGS="${goflags}"" >> "$GITHUB_ENV"
40
41 - name: Run GoReleaser
42 id: run-goreleaser
43 uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
44 with:
45 version: latest
46 args: release --clean
47 env:
48 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
49 LDFLAGS: ${{ env.GO_FLAGS }}
50
51 - name: Generate subject
52 id: hash
53 env:
54 ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
55 run: |
56 set -euo pipefail
57 checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
58 echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
59
60 - name: Set tag output
61 id: tag
62 run: echo "tag_name=${GITHUB_REF#refs/*/}" >> "$GITHUB_OUTPUT"
63
64 provenance:
65 needs: [release]
66 permissions:
67 actions: read # To read the workflow path.
68 id-token: write # To sign the provenance.
69 contents: write # To add assets to a release.
70 uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
71 with:
72 base64-subjects: "${{ needs.release.outputs.hashes }}"
73 upload-assets: true
74 upload-tag-name: "${{ needs.release.outputs.tag_name }}" # Upload to tag rather than generate a new release
75 draft-release: true
View as plain text