Prepare v1.1.0. #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: | |
| contents: write # create the release and upload assets | |
| id-token: write # cosign keyless signing + build provenance (OIDC) | |
| attestations: write # actions/attest-build-provenance | |
| jobs: | |
| release: | |
| name: GoReleaser | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 # GoReleaser needs full history and tags | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Install cosign (release signing) | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Install cyclonedx-gomod (SBOM generator) | |
| run: go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest | |
| - name: Run GoReleaser | |
| uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| distribution: goreleaser | |
| version: "~> v2" | |
| args: release --clean | |
| env: | |
| # Default token creates the release and uploads assets to this repo. | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # A separate PAT is needed to push the Homebrew cask to the tap repo; | |
| # if it is not set, GoReleaser skips the tap and the rest still runs. | |
| HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }} | |
| # The same again for the Scoop bucket, so a missing token skips only | |
| # the manifest. | |
| SCOOP_BUCKET_GITHUB_TOKEN: ${{ secrets.SCOOP_BUCKET_GITHUB_TOKEN }} | |
| # SLSA build provenance for every published archive and package, verifiable | |
| # with `gh attestation verify`. | |
| - name: Attest build provenance | |
| uses: actions/attest-build-provenance@v3 | |
| with: | |
| subject-path: "dist/*.tar.gz,dist/*.zip,dist/*.deb,dist/*.rpm" | |
| # pkg.go.dev does not watch the repository for tags. It learns about a | |
| # version from index.golang.org, which only lists versions the module | |
| # proxy has cached, and the proxy caches a version the first time someone | |
| # requests it. Nothing else requests this module, so without these two | |
| # calls the published documentation stays on the previous release | |
| # indefinitely. Neither needs credentials. | |
| # | |
| # A failure here leaves a correctly published release with stale docs, so | |
| # it must not fail the run; the same two commands can be re-run by hand. | |
| - name: Refresh pkg.go.dev | |
| continue-on-error: true | |
| env: | |
| MODULE: github.com/roberson-io/cchef | |
| VERSION: ${{ github.ref_name }} | |
| run: | | |
| curl -fsS "https://proxy.golang.org/${MODULE}/@v/${VERSION}.info" | |
| echo | |
| curl -fsS -X POST -o /dev/null \ | |
| -w 'pkg.go.dev fetch: HTTP %{http_code}\n' \ | |
| "https://pkg.go.dev/fetch/${MODULE}@${VERSION}" |