release.yaml

name: release
on:
  push:
    branches:
    - main
permissions: {}
jobs:
  release-tag:
    permissions:
      # create tag
      contents: write
    runs-on: ubuntu-latest
    outputs:
      new-tag: ${{ steps.ccv.outputs.new-tag }}
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0
    - name: Bump tag if necessary
      id: ccv
      uses: smlx/ccv@d3de774e9b607b079940a7a86952f44643743336 # v0.9.0
  release-build:
    permissions:
      # create release
      contents: write
      # required by attest-build-provenance
      id-token: write
      attestations: write
    needs: release-tag
    if: needs.release-tag.outputs.new-tag == 'true'
    strategy:
      # avoid concurrent goreleaser runs
      max-parallel: 1
      matrix:
        os:
        - ubuntu-latest
        - macos-latest
    runs-on: ${{ matrix.os }}
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0
    - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
      with:
        go-version: stable
    - name: Install Dependencies
      if: matrix.os == 'ubuntu-latest'
      run: sudo apt-get update && sudo apt-get -u install libpcsclite-dev
    - uses: advanced-security/sbom-generator-action@375dee8e6144d9fd0ec1f5667b4f6fb4faacefed # v0.0.1
      id: sbom
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Move sbom to avoid dirty git
      run: mv "$GITHUB_SBOM_PATH" ./sbom.spdx.json
      env:
        GITHUB_SBOM_PATH: ${{ steps.sbom.outputs.fileName }}
    - uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
      id: goreleaser
      with:
        version: latest
        args: release --clean --config .goreleaser.${{ matrix.os }}.yaml
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        GITHUB_SBOM_PATH: ./sbom.spdx.json
    # attest archives
    - uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
      with:
        subject-path: "dist/*.tar.gz"