release.yaml

name: Create Release

on:
  push:
    tags:
    - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10

jobs:
  cli:
    # Only release CLI for tagged releases
    if: startsWith(github.event.ref, 'refs/tags/v')

    name: Release the CLI
    runs-on: ubuntu-latest

    # https://docs.github.com/en/actions/reference/authentication-in-a-workflow
    permissions:
      id-token: write
      contents: write

    steps:
    - uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
      with:
        egress-policy: audit
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v2.2.0
      with:
        go-version-file: 'go.mod'
        check-latest: true

    - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

    - uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v2.8.1
      with:
        install-only: true

    - name: Release
      run: make release
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}