chore: prepare v0.1.0 release #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| permissions: | |
| contents: read | |
| jobs: | |
| verify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: 1.25.x | |
| cache-dependency-path: go.sum | |
| - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 | |
| with: | |
| terraform_version: 1.15.8 | |
| terraform_wrapper: false | |
| - name: Check tag and repository version consistency | |
| run: | | |
| ./scripts/check-version.sh "${GITHUB_REF_NAME#v}" | |
| git merge-base --is-ancestor "$GITHUB_SHA" origin/master | |
| - name: Check repository identity and Registry file set | |
| run: ./scripts/check-repository.sh | |
| - name: Check Go formatting | |
| run: test -z "$(gofmt -l .)" | |
| - name: Check Terraform formatting | |
| run: terraform fmt -check -recursive examples/ | |
| - name: Test | |
| run: go test ./... | |
| - name: Vet | |
| run: go vet ./... | |
| - name: Build | |
| run: go build ./... | |
| - name: Generate Registry documentation | |
| run: ./scripts/generate-docs.sh | |
| - name: Check and validate Registry documentation | |
| run: | | |
| git diff --exit-code -- docs | |
| ./scripts/validate-docs.sh | |
| - name: Initialize and validate examples | |
| run: ./scripts/validate-examples.sh terraform "${GITHUB_REF_NAME#v}" | |
| - name: Scan dependencies for known Go vulnerabilities | |
| run: go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./... | |
| - name: Scan Go source | |
| run: go run github.com/securego/gosec/v2/cmd/gosec@v2.28.0 ./... | |
| - name: Scan full Git history for secrets | |
| run: go run github.com/zricethezav/gitleaks/v8@v8.30.1 git --redact --no-banner . | |
| - name: Build unsigned snapshot release | |
| uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 | |
| with: | |
| version: v2.17.1 | |
| args: release --snapshot --skip=sign,publish --clean | |
| - name: Check snapshot release contents | |
| run: | | |
| ./scripts/stage-snapshot-manifest.sh dist/release | |
| ./scripts/check-release-artifacts.sh dist/release snapshot | |
| test -d dist/mirror/registry.terraform.io/emqx/emqxcloud/${GITHUB_REF_NAME#v} | |
| - name: Check whitespace and conflict markers | |
| run: | | |
| git add -N . | |
| git diff --check | |
| release: | |
| needs: verify | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: 1.25.x | |
| cache-dependency-path: go.sum | |
| - name: Import GPG key | |
| id: import_gpg | |
| uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 | |
| with: | |
| gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} | |
| passphrase: ${{ secrets.PASSPHRASE }} | |
| - name: Sign and publish release | |
| uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 | |
| with: | |
| version: v2.17.1 | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }} |