.goreleaser.yaml

# GoReleaser config for OpenKMS
# Version is read from .release-version into RELEASE_VERSION

version: 2

project_name: openkms

builds:
  - id: server
    binary: openkms-server
    main: ./cmd/openkms-server
    env:
      - CGO_ENABLED=0
    flags:
      - -trimpath
    ldflags:
      - -extldflags "-static"
      - -X 'github.com/Gosayram/openkms/internal/version.Version={{ .Env.RELEASE_VERSION }}'
      - -X 'github.com/Gosayram/openkms/internal/version.Commit={{ .Commit }}'
      - -X 'github.com/Gosayram/openkms/internal/version.Date={{ .Date }}'
      - -s
      - -w
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
    goarm:
      - "7"
    ignore:
      - goos: darwin
        goarch: arm64
        goarm: "7"

  - id: cli
    binary: openkms-cli
    main: ./cmd/openkms-cli
    env:
      - CGO_ENABLED=0
    flags:
      - -trimpath
    ldflags:
      - -extldflags "-static"
      - -X 'github.com/Gosayram/openkms/internal/version.Version={{ .Env.RELEASE_VERSION }}'
      - -X 'github.com/Gosayram/openkms/internal/version.Commit={{ .Commit }}'
      - -X 'github.com/Gosayram/openkms/internal/version.Date={{ .Date }}'
      - -s
      - -w
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
    goarm:
      - "7"
    ignore:
      - goos: darwin
        goarch: arm64
        goarm: "7"

archives:
  - id: default
    # Includes built binaries + files below
    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
    files:
      - README.md
      - LICENSE

checksum:
  name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt"
  algorithm: sha256

signs:
  - id: checksum
    artifacts: checksum
    signature: "${artifact}.sig"
    cmd: gpg
    args:
      - "--batch"
      - "--pinentry-mode=loopback"
      - "--passphrase={{ .Env.GPG_PASSPHRASE }}"
      - "--default-key={{ .Env.GPG_FINGERPRINT }}"
      - "--output"
      - "${signature}"
      - "--detach-sign"
      - "${artifact}"

binary_signs:
  - id: binaries
    artifacts: binary
    signature: "{{ .ArtifactName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}.sig"
    cmd: gpg
    args:
      - "--batch"
      - "--pinentry-mode=loopback"
      - "--passphrase={{ .Env.GPG_PASSPHRASE }}"
      - "--default-key={{ .Env.GPG_FINGERPRINT }}"
      - "--output"
      - "${signature}"
      - "--detach-sign"
      - "${artifact}"

release:
  mode: replace
  header: |
    ## OpenKMS {{ .Tag }}

    Release {{ .Tag }} of OpenKMS - autonomous, easily deployable, opinionated KMS for on-prem/air-gap infrastructures.

    ### Docker Images (signed with Cosign)

    Docker images are available at GitHub Container Registry (ghcr.io). All images are signed with Cosign:
    - `server:{{ .Version }}` and `server:latest`
    - `cli:{{ .Version }}` and `cli:latest`

    Verify image signatures using the public key from the repository:

    ```bash
    export USERNAME=<your-github-username>
    cosign login ghcr.io -u "$USERNAME"
    cosign verify --key cosign.pub ghcr.io/{{ .Env.DOCKER_REPO_PATH }}/server:{{ .Version }}
    ```

    The `cosign.pub` file is available in the repository root.

    ### Binaries (signed with GPG)

    This release includes the following binaries, signed with GPG:
    - `openkms-server` - OpenKMS server
    - `openkms-cli` - OpenKMS CLI tool

    ### Installation

    Download the appropriate binary or archive for your platform from the assets below.

    ### Verification

    Verify checksums:

    ```bash
    sha256sum --check {{ .ProjectName }}_{{ .Version }}_checksums.txt
    ```

    Verify checksum signature:

    ```bash
    gpg --verify {{ .ProjectName }}_{{ .Version }}_checksums.txt.sig {{ .ProjectName }}_{{ .Version }}_checksums.txt
    ```

    Verify binary signatures:

    ```bash
    # For Linux amd64
    gpg --verify openkms-server_linux_amd64.sig openkms-server
    gpg --verify openkms-cli_linux_amd64.sig openkms-cli
    
    # For other platforms, replace linux_amd64 with your platform (e.g., darwin_arm64v8, windows_amd64)
    ```
  footer: |
    **Full Changelog**: {{ .Env.GITHUB_REPO_URL }}/compare/{{ .PreviousTag }}...{{ .Tag }}

changelog:
  sort: asc
  use: github
  format: "{{ .SHA }}: {{ .Message }}{{ with .AuthorUsername }} (@{{ . }}){{ end }}"
  filters:
    exclude:
      - "^test:"
      - "^test\\("
      - "^chore: update$"
      - "^chore: docs$"
      - "^docs: update$"
      - "^chore: schema$"
      - "^chore: typo$"
      - "^chore: auto-update generated files$"
      - "^chore: update schema$"
      - "^chore: schema update$"
      - "^chore\\(deps\\): "
      - "^(build|ci): "
      - "merge conflict"
      - "merge conflict"
      - Merge pull request
      - Merge remote-tracking branch
      - Merge branch
      - go mod tidy
  groups:
    - title: "New Features"
      regexp: '^.*?(\[ADD\]|\[FEATURE\]|\[INIT\]|feat(\(.+\))?!?:|feature(\(.+\))?!?:|add(\(.+\))?!?:|init(\(.+\))?!?:|\[feature\/.+\]).*$'
      order: 100
    - title: "Performance improvements"
      regexp: '^.*?(\[perf\]|perf(\(.+\))?!?:).*$'
      order: 120
    - title: "Security updates"
      regexp: '^.*?sec(\(.+\))?!?:.+$'
      order: 150
    - title: "Bug fixes"
      regexp: '^.*?(\[FIX\]|\[BUGFIX\]|fix(\(.+\))?!?:|bugfix(\(.+\))?!?:).*$'
      order: 200
    - title: "Refactoring"
      regexp: '^.*?(\[REFACTOR\]|refactor(\(.+\))?!?:).*$'
      order: 250
    - title: "Updates and Enhancements"
      regexp: '^.*?\[UPD\].*$'
      order: 300
    - title: "Documentation updates"
      regexp: '^.*?(\[DOCS\]|docs?(\(.+\))?!?:).*$'
      order: 400
    - title: "Tests"
      regexp: '^.*?(\[TEST\]|test(\(.+\))?!?:).*$'
      order: 450
    - title: "CI and Build"
      regexp: '^.*?(\[CI\]|\[CHORE\]|\[LINT\]|ci(\(.+\))?!?:|build(\(.+\))?!?:|chore(\(.+\))?!?:|lint(\(.+\))?!?:).*$'
      order: 500
    - title: "Dependencies"
      regexp: '^.*?Bump .*$'
      order: 600
    - title: "Other work"
      order: 9999

announce:
  telegram:
    # Whether its enabled or not.
    enabled: true

    # Integer representation of your channel
    # Templates: allowed.
    chat_id: "{{ .Env.OPENKMS_CHAT_ID }}"

    # Message template to use while publishing.
    # Using MarkdownV2 format with proper escaping
    message_template: |
      🎉 *{{ mdv2escape .ProjectName }} {{ mdv2escape .Tag }}* {{ mdv2escape "is out!" }}

      📋 *{{ mdv2escape "Release Information:" }}*
      • {{ mdv2escape "Version:" }} `{{ mdv2escape .Version }}`
      • {{ mdv2escape "Commit:" }} `{{ mdv2escape .ShortCommit }}`
      • {{ mdv2escape "Date:" }} `{{ mdv2escape .Date }}`
      {{- if .PreviousTag }}
      • {{ mdv2escape "Previous:" }} `{{ mdv2escape .PreviousTag }}`
      {{- end }}

      📦 *{{ mdv2escape "Docker Images:" }}*
      {{ mdv2escape "All images are signed with Cosign and available at GitHub Container Registry:" }}
      • [{{ mdv2escape "Server" }}]({{ .Env.GITHUB_REPO_URL }}/pkgs/container/{{ .Env.REPO_NAME }}%2Fserver) `{{ mdv2escape .Version }}` / `latest`
      • [{{ mdv2escape "CLI" }}]({{ .Env.GITHUB_REPO_URL }}/pkgs/container/{{ .Env.REPO_NAME }}%2Fcli) `{{ mdv2escape .Version }}` / `latest`
      • [{{ mdv2escape "Server Slim" }}]({{ .Env.GITHUB_REPO_URL }}/pkgs/container/{{ .Env.REPO_NAME }}%2Fserver-slim) `{{ mdv2escape .Version }}` / `latest`

      📥 *{{ mdv2escape "Binaries:" }}*
      {{ mdv2escape "Signed binaries and checksums available for Linux, macOS, and Windows (amd64 and arm64) in the" }} [{{ mdv2escape "release assets" }}]({{ .ReleaseURL }})\.

      🔗 *{{ mdv2escape "Links:" }}*
      • [{{ mdv2escape "View Full Release" }}]({{ .ReleaseURL }})
      • [{{ mdv2escape "Changelog" }}]({{ .Env.GITHUB_REPO_URL }}/blob/{{ mdv2escape .Tag }}/CHANGELOG.md)
      • [{{ mdv2escape "Repository" }}]({{ .Env.GITHUB_REPO_URL }})
      {{- if .PreviousTag }}
      • [{{ mdv2escape "Compare Changes" }}]({{ .Env.GITHUB_REPO_URL }}/compare/{{ mdv2escape .PreviousTag }}...{{ mdv2escape .Tag }})
      {{- end }}

    # Parse mode.
    # Valid options are MarkdownV2 and HTML.
    parse_mode: MarkdownV2