release.yaml

name: Create Release

on:
  push:
    tags:
    - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10

env:
  GO_VERSION: '1.21'

jobs:
  cli:
    # Only release CLI for tagged releases
    if: startsWith(github.event.ref, 'refs/tags/v')

    name: Release the CLI
    runs-on: ubuntu-latest

    # https://docs.github.com/en/actions/reference/authentication-in-a-workflow
    permissions:
      id-token: write
      contents: write

    steps:
    - uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
      with:
        egress-policy: audit
    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
    - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v2.2.0
      with:
        go-version-file: 'go.mod'

    - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0

    - uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v2.8.1
      with:
        version: latest
        install-only: true

    - name: Release
      run: make release
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}