release.yml

on:
  push:
    tags:
      - v2.[0-9]+.[0-9]+
  # For testing the workflow before pushing a tag
  # This will run goreleaser with --snapshot and test the
  # SLSA generator.
  workflow_dispatch:
permissions:
  contents: read
name: release
jobs:
  goreleaser:
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
        with:
          fetch-depth: 0
      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4
        with:
          check-latest: true
      - name: Generate goreleaser args
        id: args
        run: |
          set -euo pipefail
          args='release --clean'
          if [[ "$GITHUB_REF" != refs/tags/* ]]; then
            args+=' --snapshot'
          fi
          echo "args=$args" >> $GITHUB_OUTPUT
      - uses: goreleaser/goreleaser-action@336e29918d653399e599bfca99fadc1d7ffbc9f7 # v4
        id: run-goreleaser
        with:
          args: ${{ steps.args.outputs.args }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Generate subject
        id: hash
        env:
          ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
        run: |
          set -euo pipefail

          checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
          echo "hashes=$(cat $checksum_file | base64 -w0)" >> $GITHUB_OUTPUT
  provenance:
    needs: [goreleaser]
    permissions:
      actions: read # To read the workflow path.
      id-token: write # To sign the provenance.
      contents: write # To add assets to a release.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.7.0
    with:
      compile-generator: true # Workaround for https://github.com/slsa-framework/slsa-github-generator/issues/1163
      base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
      upload-assets: ${{ github.event_name == 'push' }} # upload to a new release when pushing via tag