release.yml

name: release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write
  packages: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v6
        with:
          go-version: "1.26"

      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: sigstore/cosign-installer@v3
      - uses: anchore/sbom-action/download-syft@v0.17.8
      - uses: ko-build/setup-ko@v0.9
        env:
          KO_DOCKER_REPO: ghcr.io/${{ github.repository }}

      - name: snapshot args
        if: startsWith(github.ref, 'refs/tags/') == false
        run: echo "GORELEASER_ARGS=--snapshot --clean" >> "$GITHUB_ENV"

      - name: release args
        if: startsWith(github.ref, 'refs/tags/')
        run: echo "GORELEASER_ARGS=--clean" >> "$GITHUB_ENV"

      - uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: latest
          args: release ${{ env.GORELEASER_ARGS }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: ko publish
        if: startsWith(github.ref, 'refs/tags/')
        env:
          KO_DOCKER_REPO: ghcr.io/${{ github.repository }}
          # Consumed by ldflags templates in .ko.yaml
          VERSION: ${{ github.ref_name }}
          COMMIT: ${{ github.sha }}
        run: |
          ko build --bare --tags="${GITHUB_REF_NAME},latest" --platform=linux/amd64,linux/arm64 ./

      - name: cosign image
        if: startsWith(github.ref, 'refs/tags/')
        env:
          COSIGN_EXPERIMENTAL: "1"
        run: |
          cosign sign --yes ghcr.io/${{ github.repository }}:${GITHUB_REF_NAME}