release.yml

on:
  push:
    tags:
      - v2.[0-9]+.[0-9]+
permissions:
  contents: read
name: release
jobs:
  goreleaser:
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v3
        with:
          check-latest: true
      - uses: goreleaser/goreleaser-action@v3
        id: run-goreleaser
        with:
          args: release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Generate subject
        id: hash
        env:
          ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
          META: "${{ steps.run-goreleaser.outputs.metadata }}"
        run: |
          set -euo pipefail

          echo "artifacts:"
          echo "$ARTIFACTS"
          echo "META:"
          echo "$META"
          pwd
          tree
          checksum_file=$(cat _output/artifacts.json | jq -r '.[] | select (.type=="Checksum") | .path')
          echo "checksum_file:"
          echo "$checksum_file"
          echo "::set-output name=hashes::$(cat $checksum_file | base64 -w0)"
  test:
    runs-on: ubuntu-latest
    needs: [goreleaser]
    steps:
      - run: |
          echo "hashes:"
          echo "${{ needs.goreleaser.outputs.hashes }}"
  provenance:
    needs: [goreleaser]
    permissions:
      actions: read # To read the workflow path.
      id-token: write # To sign the provenance.
      contents: write # To add assets to a release.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.2.0
    with:
      base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
      upload-assets: true # upload to a new release

  push_bsr_plugins:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: docker/setup-buildx-action@v2
      - uses: docker/login-action@v2
        with:
          registry: plugins.buf.build
          username: grpcgatewaybot
          password: ${{ secrets.BUF_TOKEN }}
      - name: Set protobuf-version
        run: echo ::set-output name=version::$(go list -m -f '{{.Version}}' google.golang.org/protobuf)
        id: protobuf-version
      - name: Set grpc-version
        run: echo ::set-output name=version::$(go list -m -f '{{.Version}}' google.golang.org/grpc)
        id: grpc-version
      - uses: docker/build-push-action@v3
        with:
          push: true
          tags: plugins.buf.build/grpc-ecosystem/grpc-gateway:${{ github.ref_name }}-1
          context: .github/plugins/protoc-gen-grpc-gateway
          platforms: linux/amd64
          build-args: |
            RELEASE_VERSION=${{ github.ref_name }}
            GO_PROTOBUF_RELEASE_VERSION=${{ steps.protobuf-version.outputs.version }}
            GO_GRPC_RELEASE_VERSION=${{ steps.grpc-version.outputs.version }}
      - uses: docker/build-push-action@v3
        with:
          push: true
          tags: plugins.buf.build/grpc-ecosystem/openapiv2:${{ github.ref_name }}-1
          context: .github/plugins/protoc-gen-openapiv2
          platforms: linux/amd64
          build-args: |
            RELEASE_VERSION=${{ github.ref_name }}