@@ -15,28 +15,50 @@ jobs:
1515 runs-on : ubuntu-latest
1616 steps :
1717 - name : Checkout
18- uses : actions/checkout@v3
18+ uses : actions/checkout@v6
1919
2020 - name : Unshallow
2121 run : git fetch --prune --unshallow
2222
2323 - name : Set up Go
24- uses : actions/setup-go@v4
24+ uses : actions/setup-go@v6
2525 with :
26- go-version : 1.23.6
26+ go-version : 1.25.5
2727
2828 - name : Import GPG key
2929 id : import_gpg
30- uses : paultyng /ghaction-import-gpg@v2.1.0
31- env :
32- GPG_PRIVATE_KEY : ${{ secrets.GPG_PRIVATE_KEY }}
33- PASSPHRASE : ${{ secrets.PASSPHRASE }}
30+ uses : crazy-max /ghaction-import-gpg@v7
31+ with :
32+ gpg_private_key : ${{ secrets.GPG_PRIVATE_KEY }}
33+ passphrase : ${{ secrets.PASSPHRASE }}
3434
3535 - name : Run GoReleaser
36- uses : goreleaser/goreleaser-action@v6
36+ uses : goreleaser/goreleaser-action@v7
3737 with :
3838 version : ' ~> v2'
39- args : release --clean --config=.github/.goreleaser.yml
39+ args : release --clean --skip=publish -- config=.github/.goreleaser.yml
4040 env :
4141 GPG_FINGERPRINT : ${{ steps.import_gpg.outputs.fingerprint }}
4242 GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
43+
44+ - name : Verify release artifacts
45+ run : |
46+ cd dist
47+ checksums=$(ls *_SHA256SUMS)
48+ signature=$(ls *_SHA256SUMS.sig)
49+
50+ # Verify GPG signature on the checksum file
51+ # Goreleaser had bug so extra verifying as a safeguard (goreleaser#6508)
52+ gpg --verify "$signature" "$checksums"
53+
54+ # Verify checksums match actual artifacts
55+ sha256sum -c "$checksums"
56+
57+ - name : Publish release
58+ uses : goreleaser/goreleaser-action@v7
59+ with :
60+ version : ' ~> v2'
61+ args : continue --config=.github/.goreleaser.yml
62+ workdir : .
63+ env :
64+ GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
0 commit comments