.goreleaser.yaml

# Copyright (c) 2026, NVIDIA CORPORATION.  All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

version: 2

project_name: aicr

builds:
  - id: aicr
    binary: aicr
    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
    dir: cmd/aicr
    env:
      - CGO_ENABLED=0
      - GOFLAGS=-mod=vendor
    flags:
      - -trimpath
    ldflags: &build-ldflags |
      -w
      -s
      -extldflags "-static"
      -X github.com/NVIDIA/aicr/pkg/cli.version={{.Version}}
      -X github.com/NVIDIA/aicr/pkg/cli.commit={{.ShortCommit}}
      -X github.com/NVIDIA/aicr/pkg/cli.date={{.Date}}
    hooks:
      post:
        ## cosign v1 attestation with slsa provenance v1.
        ## NOTE: below aicrd currently attests via github attestation
        - cmd: >-
            bash -c '[ -z "${SLSA_PREDICATE:-}" ] && exit 0;
            cosign attest-blob
            --predicate "${SLSA_PREDICATE}"
            --type https://slsa.dev/provenance/v1
            --bundle "$(dirname "{{ .Path }}")/aicr-attestation.sigstore.json"
            --yes "{{ .Path }}"'
          output: true
    goos:
      - darwin
      - linux
    goarch:
      - amd64
      - arm64

  - id: aicrd
    binary: aicrd
    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
    dir: cmd/aicrd
    env:
      - CGO_ENABLED=0
      - GOFLAGS=-mod=vendor
    flags:
      - -trimpath
    ldflags: &build-ldflags |
      -w
      -s
      -extldflags "-static"
      -X github.com/NVIDIA/aicr/pkg/api.version={{.Version}}
      -X github.com/NVIDIA/aicr/pkg/api.commit={{.ShortCommit}}
      -X github.com/NVIDIA/aicr/pkg/api.date={{.Date}}
    goos:
      - linux
    goarch:
      - amd64
      - arm64


gomod:
  proxy: false

sboms:
  - artifacts: binary

checksum:
  name_template: "{{ .ProjectName }}_checksums.txt"
  algorithm: sha256

snapshot:
  version_template: "{{ .Tag }}-next"

report_sizes: true

metadata:
  mod_timestamp: "{{ .CommitTimestamp }}"

release:
  github:
    owner: NVIDIA
    name: aicr
  prerelease: auto
  draft: true

kos:
  - id: aicr
    build: aicr
    repositories:
      - ghcr.io/nvidia/aicr
    base_image: nvcr.io/nvidia/cuda:13.1.0-runtime-ubuntu24.04
    platforms:
      - linux/amd64
      - linux/arm64
    tags:
      - latest
      - "{{.Tag}}"
    preserve_import_paths: false
    bare: true

  - id: aicrd
    build: aicrd
    repositories:
      - ghcr.io/nvidia/aicrd
    base_image: gcr.io/distroless/static:nonroot
    platforms:
      - linux/amd64
      - linux/arm64
    tags:
      - latest
      - "{{.Tag}}"
    preserve_import_paths: false
    bare: true

archives:
  - id: aicr
    ids:
      - aicr
    formats:
      - tar.gz
    name_template: "{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
    files:
      - src: "dist/aicr_{{ .Os }}_{{ .Arch }}*/aicr-attestation.sigstore.json"
        strip_parent: true

changelog:
  sort: asc
  use: github
  filters:
    exclude:
      - "^build:"
      - "^docs:"
      - "^test:"
      - "^lint:"
      - "^chore: readme"
      - "^chore: bump version"
  groups:
    - title: "New Features"
      regexp: '^.*?feat(\([[:word:]]+\))??!?:.+$'
      order: 0
    - title: "Bug Fixes"
      regexp: '^.*?(fix|bug)(\([[:word:]]+\))??!?:.+$'
      order: 1
    - title: "Other Tasks"
      order: 999

brews:
  - ids:
      - aicr
    repository:
      owner: NVIDIA
      name: homebrew-aicr
      git:
        url: "ssh://git@github.com/NVIDIA/homebrew-aicr.git"
        private_key: "{{ .Env.HOMEBREW_DEPLOY_KEY }}"
    skip_upload: "{{ if .Env.HOMEBREW_DEPLOY_KEY }}false{{ else }}true{{ end }}"
    commit_author:
      name: github-actions
      email: github-actions@github.com
    commit_msg_template: "Brew formula update for {{ .ProjectName }} version {{ .Tag }}"
    directory: Formula
    homepage: "https://github.com/NVIDIA/aicr"
    description: "Tooling for deploying optimized, validated, and reproducible GPU-accelerated AI runtime in Kubernetes."
    license: "Apache-2.0"
    install: |
      bin.install "aicr"
      # Install attestation bundle next to binary (aicr looks for <binary>-attestation.sigstore.json)
      bin.install "aicr-attestation.sigstore.json" if File.exist? "aicr-attestation.sigstore.json"
      # Verify provenance attestation if cosign is available
      if File.exist?(bin/"aicr-attestation.sigstore.json") && which("cosign")
        system "cosign", "verify-blob-attestation",
               "--bundle", bin/"aicr-attestation.sigstore.json",
               "--type", "https://slsa.dev/provenance/v1",
               "--certificate-oidc-issuer", "https://token.actions.githubusercontent.com",
               "--certificate-identity-regexp", "https://github.com/NVIDIA/aicr/.github/workflows/on-tag\\.yaml@refs/tags/.*",
               bin/"aicr"
        ohai "Provenance verified — binary built by github.com/NVIDIA/aicr CI pipeline"
      end
    caveats: |
      To enable supply chain verification, update the bundle attestation root:

        aicr trust update