Merge branch 'develop' (v0.8.0) #41
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Release: runs on tag push (v*). Publishes binaries and Docker image via GoReleaser. | |
| # Trigger: git tag v0.1.2 && git push origin v0.1.2 | |
| # Requires: release-check passed before tagging (make release-check; includes docker-scan). | |
| name: Release | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| jobs: | |
| release: | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| # install-only so `make release-check` can verify `goreleaser` is on PATH (same idea as local dev). | |
| - name: Install GoReleaser | |
| uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| distribution: goreleaser | |
| version: latest | |
| install-only: true | |
| - name: Run release checks | |
| run: make release-check | |
| # QEMU + Buildx + GHCR login: required for GoReleaser dockers_v2 multi-arch on ubuntu-latest | |
| # ("Multi-platform build is not supported for the docker driver" without them). | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GH Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Require Homebrew tap token | |
| env: | |
| HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} | |
| run: | | |
| if [ -z "$HOMEBREW_TAP_TOKEN" ]; then | |
| echo "::error::Homebrew tap publish secret is not set (Actions secret for write access to hrodrig/homebrew-gghstats). See .github/workflows/release.yml." | |
| exit 1 | |
| fi | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@v3 | |
| # GoReleaser sboms: invokes syft; not bundled by goreleaser-action. | |
| - name: Install syft (SBOM) | |
| uses: anchore/sbom-action/download-syft@v0 | |
| - name: Run GoReleaser | |
| uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| distribution: goreleaser | |
| version: latest | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # PAT with contents:write on hrodrig/homebrew-gghstats (GITHUB_TOKEN cannot push to another repo). | |
| HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} |