chore(ci): add fork-friendly release workflow for testing

Author: DmitriyLewen

.github/workflows/release-fork.yml

@@ -0,0 +1,53 @@
+name: Release (fork test)
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  release:
+    name: Release (RPM/DEB only)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: ./.github/actions/setup-go
+
+      - name: Save GPG key to file
+        env:
+          GPG_KEY: ${{ secrets.GPG_KEY }}
+        run: echo "$GPG_KEY" > /tmp/gpg.key
+
+      - name: GoReleaser (RPM/DEB only)
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.3.0
+        with:
+          version: ~> v2
+          args: release -f goreleaser-fork.yml --clean --timeout 30m
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NFPM_DEFAULT_RPM_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          GPG_FILE: /tmp/gpg.key
+
+      - name: Remove GPG key file
+        if: always()
+        run: rm -f /tmp/gpg.key
+
+  deploy-packages:
+    name: Trigger deploy-packages
+    needs: release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger deploy-packages workflow in trivy-repo
+        env:
+          GH_TOKEN: ${{ secrets.ORG_REPO_TOKEN }}
+        run: |
+          gh workflow run deploy-packages.yml \
+            --repo "$GITHUB_REPOSITORY_OWNER/trivy-repo" \
+            --ref main \
+            --field "version=$GITHUB_REF_NAME"

goreleaser-fork.yml

@@ -0,0 +1,54 @@
+version: 2
+
+project_name: trivy
+
+builds:
+  - id: build-linux
+    main: ./cmd/trivy/
+    binary: trivy
+    ldflags:
+      - -s -w
+      - "-extldflags '-static'"
+      - -X github.com/aquasecurity/trivy/pkg/version/app.ver={{.Version}}
+    env:
+      - CGO_ENABLED=0
+      - GOEXPERIMENT=jsonv2
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+
+release:
+  discussion_category_name: ""
+
+nfpms:
+  -
+    formats:
+      - deb
+      - rpm
+    vendor: "aquasecurity"
+    homepage: "https://github.com/aquasecurity"
+    maintainer: "Aqua Security <oss@aquasec.com>"
+    description: "A Fast Vulnerability Scanner for Containers"
+    license: "Apache-2.0"
+    file_name_template: >-
+      {{ .ProjectName }}_{{ .Version }}_
+      {{- if eq .Os "darwin" }}macOS
+      {{- else if eq .Os "openbsd" }}OpenBSD
+      {{- else if eq .Os "netbsd" }}NetBSD
+      {{- else if eq .Os "freebsd" }}FreeBSD
+      {{- else if eq .Os "dragonfly" }}DragonFlyBSD
+      {{- else}}{{- title .Os }}{{ end }}-
+      {{- if eq .Arch "amd64" }}64bit
+      {{- else if eq .Arch "386" }}32bit
+      {{- else if eq .Arch "arm" }}ARM
+      {{- else if eq .Arch "arm64" }}ARM64
+      {{- else if eq .Arch "ppc64le" }}PPC64LE
+      {{- else }}{{ .Arch }}{{ end }}
+    contents:
+     - src: contrib/*.tpl
+       dst: /usr/local/share/trivy/templates
+    rpm:
+      signature:
+        key_file: '{{ .Env.GPG_FILE }}'