go.yml

name: Bulid, sign and release binaries

on:
  workflow_dispatch:
  push:
    # Sequence of patterns matched against refs/tags
    tags:
      - 'v*.*.*' # Push events to matching v*, i.e. v1.0, v20.15.10

jobs:

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:

    - name: Set up Go 1.x
      uses: actions/setup-go@v5
      with:
        go-version: 1.23
      id: go

    - name: Check out code into the Go module directory
      uses: actions/checkout@v2

    - name: Import GPG key
      id: import_gpg
      uses: crazy-max/ghaction-import-gpg@v3
      with:
        gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
        passphrase: ${{ secrets.PASSPHRASE }}
        git-user-signingkey: true
        git-commit-gpgsign: true

    - name: Printing GPG user config
      run: |
        echo "fingerprint: ${{ steps.import_gpg.outputs.fingerprint }}"
        echo "keyid:       ${{ steps.import_gpg.outputs.keyid }}"
        echo "name:        ${{ steps.import_gpg.outputs.name }}"

    - uses: anchore/sbom-action/download-syft@v0.18.0 # installs syft
      name: Download syft

    - name: Build and Release
      uses: goreleaser/goreleaser-action@v2
      if: startsWith(github.ref, 'refs/tags/')
      with:
        version: latest
        args: release --clean
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}