release.yaml

# Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
#
# SPDX-License-Identifier: MIT

name: Release with goreleaser

on:
  workflow_dispatch:
  push:
    tags:
      - v*

permissions: write-all # Necessary for the generate-build-provenance action with containers

jobs:

  build:


    runs-on: ubuntu-latest

    steps:
      - name: Set up latest stable Go
        uses: actions/setup-go@v6.4.0
        with:
          go-version: stable
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4.0.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4.0.0
        with:
          driver-opts: |
            image=moby/buildkit:master
            network=host
      - name: Docker Login
        uses: docker/login-action@v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          fetch-tags: 1
          fetch-depth: 0
      - name: Install cross-compilers for CGO builds
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu libc6-dev-arm64-cross
      # Set environment variables required by GoReleaser
      - name: Set build environment variables
        run: |
          echo "GIT_STATE=$(if git diff-index --quiet HEAD --; then echo 'clean'; else echo 'dirty'; fi)" >> $GITHUB_ENV
          echo "BUILD_HOST=$(hostname)" >> $GITHUB_ENV
          echo "GO_VERSION=$(go version | awk '{print $3}')" >> $GITHUB_ENV
          echo "BUILD_USER=$(whoami)" >> $GITHUB_ENV
          echo "CGO_ENABLED=1" >> $GITHUB_ENV
          echo "IS_PR_BUILD=false" >> $GITHUB_ENV

      - name: Release with goreleaser
        uses: goreleaser/goreleaser-action@v7.2.2
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          version: latest
          args: release --clean
        id: goreleaser
      - name: Process goreleaser output
        id: process_goreleaser_output
        run: |
          echo "const fs = require('fs');" > process.js
          echo 'const artifacts = ${{ steps.goreleaser.outputs.artifacts }}' >> process.js
          echo "const firstNonNullDigest = artifacts.find(artifact => artifact.extra && artifact.extra.Digest != null)?.extra.Digest;" >> process.js
          echo "console.log(firstNonNullDigest);" >> process.js
          echo "fs.writeFileSync('digest.txt', firstNonNullDigest);" >> process.js
          node process.js
          echo "digest=$(cat digest.txt)" >> $GITHUB_OUTPUT
      - name: Attest Binaries
        uses: actions/attest-build-provenance@v4.1.0
        with:
          subject-path: dist/**/fru-tracker*
      - name: generate build provenance
        uses: actions/attest-build-provenance@v4.1.0
        with:
          subject-name: ghcr.io/openchami/fru-tracker
          subject-digest: ${{ steps.process_goreleaser_output.outputs.digest }}
          push-to-registry: true