release.yml

# SPDX-FileCopyrightText: 2025 itiquette/git-provider-sync
#
# SPDX-License-Identifier: CC0-1.0
---
name: GoReleaser

on:
  workflow_call:
    outputs:
      hashes:
        value: ${{ jobs.goreleaser.outputs.hashes }}
      image:
        value: ${{ jobs.goreleaser.outputs.image }}
      digest:
        value: ${{ jobs.goreleaser.outputs.digest }}

permissions:
  contents: read

jobs:
  goreleaser:
    permissions:
      contents: write # needed to write releases
      id-token: write # needed for keyless signing
      packages: write # needed for ghcr access

    name: GoReleaser build and release
    outputs:
      hashes: ${{ steps.binary.outputs.hashes }}
      image: ${{ steps.image.outputs.name }}
      digest: ${{ steps.image.outputs.digest }}
    runs-on: ubuntu-latest
    environment: GPSENV

    if: success() && startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Harden GitHub runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0
          ref: main

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version: "stable"
          cache: true

      # - name: Configure Git for private modules
      #   env:
      #     GITHUB_API_TOKEN: ${{ secrets.GH_API_TOKEN }}
      #   run: git config --global url."https://x:${GITHUB_API_TOKEN}@github.com".insteadOf "https://github.com"

      - uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate Releasenotes
        uses: orhun/git-cliff-action@4a4a951bc43fafe41cd2348d181853f52356bee7 # v4
        with:
          args: --latest
        env:
          OUTPUT: ReleasenotesTmp
          GITHUB_REPO: ${{ github.repository }}

      - name: Run GoReleaser
        id: goreleaser
        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean --release-notes=ReleasenotesTmp
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate binary hashes
        id: binary
        env:
          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
        run: |
          set -euo pipefail
          checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
          echo "hashes=$(base64 -w0 < "$checksum_file")" >> "$GITHUB_OUTPUT"

      - name: Image digest
        id: image
        env:
          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
        run: |
          set -euo pipefail
          image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Manifest") | .path +":"+ .extra.Digest')
          image=$(echo "${image_and_digest}" | cut -d':' -f1 | uniq)
          digest=$(echo "${image_and_digest}" | cut -d':' -f3,4 | uniq)
          echo "name=$image" >> "$GITHUB_OUTPUT"
          echo "digest=$digest" >> "$GITHUB_OUTPUT"