publish.yml

# This GitHub action can publish assets for release when a tag is created.
# Currently its setup to run on any tag that matches the pattern "v*" (ie. v0.1.0).
#
# This uses an action (crazy-max/ghaction-import-gpg) that assumes you set your
# private key in the `GPG_PRIVATE_KEY` secret and passphrase in the `PASSPHRASE`
# secret. If you would rather own your own GPG handling, please fork this action
# or use an alternative one for key handling.
#
name: Publish Release

on:
  push:
    tags:
      - "v*"

permissions:
  id-token: write
  contents: read
  attestations: write

jobs:
  goreleaser:
    runs-on: ubuntu-24.04
    steps:
      - name: Generate Short Lived OAuth App Token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          app-id: "${{ secrets.BOT_APP_ID }}"
          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
          owner: "${{ github.repository_owner }}"
          repositories: "${{ github.event.repository.name }}"

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0

      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
        with:
          gpg_private_key: "${{ secrets.GPG_PRIVATE_KEY }}"
          passphrase: "${{ secrets.PASSPHRASE }}"

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          version: '~> v2'
          args: release --clean
        env:
          GPG_FINGERPRINT: "${{ steps.import_gpg.outputs.fingerprint }}"
          GITHUB_TOKEN: "${{ steps.app-token.outputs.token }}"

      - name: Attest
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4
        with:
          subject-path: ./dist/*.zip
        env:
          GITHUB_TOKEN: "${{ steps.app-token.outputs.token }}"