Added new Confused Deputy Auto-Merge rule (#304) #29

	name: goreleaser

	on:
	push:
	# run only against tags
	tags:
	- "v0.[0-9]+.[0-9]+"
	- "v1.[0-9]+.[0-9]+"

	env:
	GO_VERSION: 1.24
	GO_RELEASER_VERSION: v2.4.7

	permissions: {}

	jobs:
	goreleaser:
	runs-on: ubuntu-latest
	permissions:
	contents: write
	packages: write
	id-token: write
	steps:
	- uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
	with:
	egress-policy: audit
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
	with:
	fetch-depth: 0
	- name: Setup Go
	uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
	with:
	go-version: ${{ env.GO_VERSION }}
	cache: false
	- uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
	- name: Login to GitHub Container Registry to allow cosign signature push
	run: echo "$DOCKER_PASSWORD" \| docker login ghcr.io --username "$DOCKER_USERNAME" --password-stdin
	env:
	DOCKER_USERNAME: ${{ github.actor }}
	DOCKER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
	- name: Run GoReleaser
	uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
	with:
	distribution: goreleaser
	version: ${{ env.GO_RELEASER_VERSION }} # Not pinnable by hash, nor does it verify its signature
	args: release --clean
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback