release.yaml

name: Release

on:
  push:
    tags:
    - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10

jobs:
  release:
    runs-on: ubuntu-latest

    permissions:
      id-token: write
      packages: write
      contents: write

    env:
      GOPATH: ${{ github.workspace }}
      GO111MODULE: on
      COSIGN_EXPERIMENTAL: "true"

    steps:
    - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
      with:
        go-version: '1.21'
        check-latest: true

    - name: Install ko
      uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6

    - name: Install cosign
      uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0

    - name: Install GoReleaser
      uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v3.1.0
      with:
        install-only: true

    - name: Log into ghcr.io
      uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v2.0.0
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Check out code onto GOPATH
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        fetch-depth: 1
        path: ./src/github.com/${{ github.repository }}

    - name: Get TAG
      id: get_tag
      run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

    - name: Run goreleaser
      working-directory: ./src/github.com/${{ github.repository }}
      run: goreleaser release --clean --timeout 120m
      env:
        GIT_TAG: ${{ steps.get_tag.outputs.TAG }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}