wolfictl/.github/workflows/release.yaml at main · wolfi-dev/wolfictl · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
name: release

on:
  schedule:
    - cron: '0 0 * * 1' # weekly on Monday at 00:00
  workflow_dispatch:
    inputs:
      dry_run:
        description: "dry-run mode: if true, no git tags will be pushed."
        type: boolean
        default: false
      release_type:
        description: "Type of Release"
        required: true
        default: patch
        type: choice
        options:
          - major
          - minor
          - patch
          - prerelease
      forced_version:
        description: "(Optional) SemVer2-compliant forced-version to tag explicitly, instead of auto-bumping.
                      Must not already exist"
        required: false
        type: string

permissions: {}

jobs:
  release:
    name: release
    runs-on: ubuntu-latest

    permissions:
      contents: read
      id-token: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
        id: octo-sts
        with:
          scope: ${{ github.repository }}
          identity: release

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0 # fetch all history for all tags and branches
          token: ${{ steps.octo-sts.outputs.token }}

      - uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: 'go.mod'
          check-latest: true

      - name: Check if any changes since last tag
        id: check
        run: |
          git fetch --tags
          if [ -z "$(git tag --points-at HEAD)" ]; then
            echo "Nothing points at HEAD, bump a new tag"
            echo "bump=yes" >> "$GITHUB_OUTPUT"
          else
            echo "A tag already points to head, don't bump"
            echo "bump=no" >> "$GITHUB_OUTPUT"
          fi

      - name: Bump and push Git tag
        uses: chainguard-dev/actions/git-tag@061bc0e921116bde1470f51fb5c86d5318f16558 # v1.6.15
        if: steps.check.outputs.bump == 'yes'
        with:
          token: ${{ steps.octo-sts.outputs.token }}
          git_tag_prefix: "v"
          bump_level: ${{ inputs.release_type || 'patch' }}
          dry_run: ${{ inputs.dry_run || 'false'}}
          forced_version: ${{ inputs.forced_version || '' }}
          author: "octo-sts[bot] <157150467+octo-sts[bot]@users.noreply.github.com>"
          committer: "octo-sts[bot] <157150467+octo-sts[bot]@users.noreply.github.com>"

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c # v7.1.0
        if: steps.check.outputs.bump == 'yes'
        with:
          distribution: goreleaser
          version: latest
          args: release --clean --parallelism 1
        env:
          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}