release.yaml

name: Release

on:
  push:
    tags:
    - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10

jobs:
  release:
    runs-on: ubuntu-latest

    permissions:
      id-token: write
      packages: write
      contents: write

    env:
      GOPATH: ${{ github.workspace }}
      GO111MODULE: on
      COSIGN_EXPERIMENTAL: "true"

    steps:
    - name: Check out code onto GOPATH
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 1
        path: ./src/github.com/${{ github.repository }}

    - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
      with:
        go-version-file: ./src/github.com/${{ github.repository }}/go.mod
        check-latest: true

    - name: Install ko
      uses: ko-build/setup-ko@3aebd0597dc1e9d1a26bcfdb7cbeb19c131d3037 # v0.7

    - name: Install cosign
      uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

    - name: Install GoReleaser
      uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v3.1.0
      with:
        install-only: true

    - name: Log into ghcr.io
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Get TAG
      id: get_tag
      run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

    - name: Run goreleaser
      working-directory: ./src/github.com/${{ github.repository }}
      run: goreleaser release --clean --timeout 120m
      env:
        GIT_TAG: ${{ steps.get_tag.outputs.TAG }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}