release.yml

permissions:
  id-token: write # This is required for requesting the JWT
  contents: read  # This is required for actions/checkout
name: release
on: [push, pull_request]
jobs:
  test:
    strategy:
      matrix:
        go-version: [ 1.19.x ]
        os: [ ubuntu-latest ]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Install Go
        uses: actions/setup-go@v2
        with:
          go-version: ${{ matrix.go-version }}
      - name: Checkout code
        uses: actions/checkout@v2
      - uses: actions/cache@v2
        with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
            ${{ runner.os }}-go-
      - name: Format Unix
        run: test -z $(go fmt ./...)
      - name: Install GoKart
        run: go install github.com/praetorian-inc/gokart@latest

      - name: Static Analysis
        uses: testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934
        with:
          step: static-analysis
          attestations: "github sarif"
          command: gokart scan . -o sarif-results.json -s

      - name: Test
        uses: testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934
        with: 
          step: "test"
          attestations: "github"
          command: go test -v -coverprofile=profile.cov -covermode=atomic ./...

      - name: Send coverage
        env:
          COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          GO111MODULE=off go get github.com/mattn/goveralls
          $(go env GOPATH)/bin/goveralls -coverprofile=profile.cov -service=github

  release:
    permissions:
      id-token: write
      contents: write
      packages: write
    runs-on: ubuntu-latest
    needs: test
    if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
    
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v2
        with:
          go-version: 1.20.x
      - uses: actions/cache@v2
        with:
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Download GoReleaser
        run: go install github.com/goreleaser/goreleaser@latest

      - name: Run GoReleaser
        uses: testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
        with:
          step: "build"
          attestations: "github"
          command: goreleaser release --clean