Bump jdx/mise-action from 3.6.0 to 3.6.1 in the all group (#20) #4

	# SPDX-FileCopyrightText: 2026 Kalle Fagerberg
	#
	# SPDX-License-Identifier: CC0-1.0

	name: release
	on:
	push:
	tags:
	- "v*"

	permissions: {}

	jobs:
	release:
	runs-on: ubuntu-latest
	permissions:
	# Required to upload binaries to GitHub releases
	contents: write
	# Required for signing (sigstore)
	attestations: write
	# Required for using GitHub IdP (when signing)
	id-token: write
	steps:
	- name: checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: setup go
	uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # 6.2.0
	with:
	go-version-file: go.mod
	cache: false # no cache to avoid cache-poisoning: https://docs.zizmor.sh/audits/#cache-poisoning

	- uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1
	with:
	cache: false # no cache to avoid cache-poisoning: https://docs.zizmor.sh/audits/#cache-poisoning

	- name: create package
	run: \|
	mise run package

	- name: attest release artifacts
	uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0
	with:
	subject-path: "dist/*.zip"

	- name: upload assets to release
	env:
	GH_TOKEN: ${{ github.token }}
	run: \|
	gh release upload "$GITHUB_REF_NAME" -- dist/*.zip

Navigation Menu