.goreleaser.yaml

version: 2
before:
  hooks:
  - go mod tidy
  - make notice
builds:
- env:
  - CGO_ENABLED=0
  flags:
  - -trimpath
  goos:
  - linux
  - windows
  - darwin
  goarch:
  - amd64
  - arm64
  ldflags:
  - -s -w -X github.com/rstudio/rskey/cmd.Version={{ .Version }}
  mod_timestamp: '{{ .CommitTimestamp }}'
archives:
- files:
  - LICENSE
  - README.md
  - NOTICE.md
  format_overrides:
  - goos: windows
    formats:
    - zip
blobs:
- provider: s3
  bucket: rstudio-platform-public-artifacts
  directory: "platform/rskey/{{ .Version }}"
release:
  draft: true
  header: |
    `rskey` is a command-line tool (and bundled Go packages) that generates secret keys interoperable with the format used by Posit's Workbench, Connect, and Package Manager products.

    ## Changes since v{{ .Version }}
  footer: |
    ## Binary signatures

    Binary releases are signed with [Sigstore](https://www.sigstore.dev/). You can verify these signatures with their `cosign` tool, for example:

    ``` shell
    $ cosign verify-blob \
      --signature rskey_{{ .Version }}_linux_amd64.tar.gz.sig \
      rskey_{{ .Version }}_linux_amd64.tar.gz
    ```

    We use Cosign's ["keyless"](https://docs.sigstore.dev/cosign/signing/overview/) mode, which uses the OpenID Connect tokens issued by GitHub for this repository and ephemeral certificates instead of private keys.
signs:
- cmd: cosign
  signature: "${artifact}.sig"
  args: ["sign-blob", "--output-signature=${signature}", "${artifact}", "--yes"]
  artifacts: all
source:
  enabled: true
nfpms:
- id: rskey
  builds:
  - rskey
  formats:
  - deb
  - rpm
  section: devel
  maintainer: "Posit Software, PBC <info@posit.co>"
  description: |
    A command-line tool that generates secret keys interoperable with the format
    used by Posit's Workbench, Connect, and Package Manager products.
  contents:
  - src: LICENSE
    dst: /usr/share/doc/rskey/LICENSE
  - src: README.md
    dst: /usr/share/doc/rskey/README.md
  - src: NOTICE.md
    dst: /usr/share/doc/rskey/NOTICE.md