CHORE: dependency updates #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: smtpdane tool release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| # Control the GITHUB_TOKEN permissions; GitHub's docs on which permission scopes control what are a little lacking. | |
| # By having this block, all permissions not listed here are set to none. | |
| # | |
| # <https://goreleaser.com/ci/actions/> documents which scopes are needed for it. | |
| # Permissions assigned at job level. | |
| permissions: {} | |
| # Since invoking this workflow is for a release tag, and those should be | |
| # immutable when pushed, I would prefer it if attempts to be concurrent could | |
| # be a poison on the tag. But failing that, the correct behavior is to cancel the previous run. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| goreleaser: | |
| name: GoReleaser Build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Uploading archives as release artifacts is bundled into the contents: permission key! (goreleaser documents as content: but it's contents:). | |
| # packages: is for pushing docker images to github (ghcr.io) | |
| # actions: is for uploading artifacts | |
| # Repeating in short-form below, so that zizmor sees that yes, we have supplied reasons. | |
| contents: write # archives upload | |
| packages: write # OCI image push | |
| actions: write # artifacts upload | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| # NB: the `fetch-depth: 0` setting is documented by goreleaser | |
| # as a requirement, for the changelog feature to work correctly. | |
| fetch-depth: 0 | |
| # We don't need to work with the git remote after this, so: | |
| persist-credentials: false | |
| # If we had something suitable for a Docker image, here we would setup QEMU and BuildX | |
| - name: Set up Go | |
| uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 | |
| with: | |
| go-version: 'stable' | |
| check-latest: true | |
| # We are producing a release artifact, so should accept the penalty | |
| # cost of uncached builds and avoid the risk of cache poisoning via | |
| # PRs. | |
| cache: false | |
| - name: Basic Go integrity checks | |
| run: | | |
| go vet ./... | |
| t="$(go list -m -retracted -f '{{if .Retracted}}::error file=go.mod::{{.Path}} is retracted{{end}}' all)" | |
| if [ ".$t" != "." ]; then printf '%s\n' "$t"; exit 1; fi | |
| - name: Version / Environment Reporting | |
| run: | | |
| ./build/show.versions | |
| - name: Run GoReleaser | |
| id: goreleaser | |
| uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0 | |
| with: | |
| distribution: goreleaser | |
| version: "~> v2" | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |