release: v0.1.0 signed supply chain (#66) #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| GO_VERSION: "1.26.5" | |
| GORELEASER_VERSION: "v2.17.0" | |
| SYFT_VERSION: "v1.46.0" | |
| COSIGN_VERSION: "v3.0.6" | |
| jobs: | |
| release: | |
| name: build · sign · attest · publish | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Validate stable tag and release ancestry | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "::error::release tags must be stable semantic versions such as v0.1.0" | |
| exit 1 | |
| fi | |
| git fetch --no-tags origin main | |
| if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then | |
| echo "::error::release tag must point to a commit reachable from main" | |
| exit 1 | |
| fi | |
| if [ "$(git cat-file -t "$GITHUB_REF_NAME")" != "tag" ]; then | |
| echo "::error::release tag must be annotated" | |
| exit 1 | |
| fi | |
| tag_object=$(git rev-parse "$GITHUB_REF_NAME^{tag}") | |
| if [ "$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${tag_object}" --jq '.verification.verified')" != "true" ]; then | |
| echo "::error::release tag must carry a signature verified by GitHub" | |
| exit 1 | |
| fi | |
| echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV" | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| check-latest: false | |
| cache: true | |
| cache-dependency-path: go.sum | |
| - name: Install pinned Syft | |
| uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 | |
| with: | |
| syft-version: ${{ env.SYFT_VERSION }} | |
| - name: Install pinned Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| with: | |
| cosign-release: ${{ env.COSIGN_VERSION }} | |
| - name: Download and verify modules | |
| run: | | |
| go mod download | |
| go mod verify | |
| - name: Build signed draft release | |
| uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 | |
| with: | |
| version: ${{ env.GORELEASER_VERSION }} | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Verify release assets and render Homebrew formula | |
| run: | | |
| go run ./tools/releasecheck verify --dist dist | |
| go run ./tools/releasecheck formula \ | |
| --dist dist \ | |
| --tag "$GITHUB_REF_NAME" \ | |
| --output dist/sith.rb | |
| - name: Sign Homebrew formula | |
| run: cosign sign-blob --yes --bundle=dist/sith.rb.sigstore.json dist/sith.rb | |
| - name: Generate SLSA build provenance | |
| id: provenance | |
| uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 | |
| with: | |
| subject-checksums: dist/checksums.txt | |
| - name: Attest darwin amd64 SBOM | |
| id: sbom_darwin_amd64 | |
| uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 | |
| with: | |
| subject-path: dist/sith_${{ env.VERSION }}_darwin_amd64.tar.gz | |
| sbom-path: dist/sith_${{ env.VERSION }}_darwin_amd64.tar.gz.spdx.json | |
| - name: Attest darwin arm64 SBOM | |
| id: sbom_darwin_arm64 | |
| uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 | |
| with: | |
| subject-path: dist/sith_${{ env.VERSION }}_darwin_arm64.tar.gz | |
| sbom-path: dist/sith_${{ env.VERSION }}_darwin_arm64.tar.gz.spdx.json | |
| - name: Attest linux amd64 SBOM | |
| id: sbom_linux_amd64 | |
| uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 | |
| with: | |
| subject-path: dist/sith_${{ env.VERSION }}_linux_amd64.tar.gz | |
| sbom-path: dist/sith_${{ env.VERSION }}_linux_amd64.tar.gz.spdx.json | |
| - name: Attest linux arm64 SBOM | |
| id: sbom_linux_arm64 | |
| uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 | |
| with: | |
| subject-path: dist/sith_${{ env.VERSION }}_linux_arm64.tar.gz | |
| sbom-path: dist/sith_${{ env.VERSION }}_linux_arm64.tar.gz.spdx.json | |
| - name: Attach attestations and Homebrew formula | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PROVENANCE_BUNDLE: ${{ steps.provenance.outputs.bundle-path }} | |
| SBOM_DARWIN_AMD64_BUNDLE: ${{ steps.sbom_darwin_amd64.outputs.bundle-path }} | |
| SBOM_DARWIN_ARM64_BUNDLE: ${{ steps.sbom_darwin_arm64.outputs.bundle-path }} | |
| SBOM_LINUX_AMD64_BUNDLE: ${{ steps.sbom_linux_amd64.outputs.bundle-path }} | |
| SBOM_LINUX_ARM64_BUNDLE: ${{ steps.sbom_linux_arm64.outputs.bundle-path }} | |
| run: | | |
| set -euo pipefail | |
| install -m 0644 "$PROVENANCE_BUNDLE" "dist/sith_${VERSION}_provenance.sigstore.json" | |
| install -m 0644 "$SBOM_DARWIN_AMD64_BUNDLE" "dist/sith_${VERSION}_darwin_amd64.sbom.sigstore.json" | |
| install -m 0644 "$SBOM_DARWIN_ARM64_BUNDLE" "dist/sith_${VERSION}_darwin_arm64.sbom.sigstore.json" | |
| install -m 0644 "$SBOM_LINUX_AMD64_BUNDLE" "dist/sith_${VERSION}_linux_amd64.sbom.sigstore.json" | |
| install -m 0644 "$SBOM_LINUX_ARM64_BUNDLE" "dist/sith_${VERSION}_linux_arm64.sbom.sigstore.json" | |
| gh release upload "$GITHUB_REF_NAME" \ | |
| dist/sith.rb \ | |
| dist/sith.rb.sigstore.json \ | |
| "dist/sith_${VERSION}_provenance.sigstore.json" \ | |
| "dist/sith_${VERSION}_darwin_amd64.sbom.sigstore.json" \ | |
| "dist/sith_${VERSION}_darwin_arm64.sbom.sigstore.json" \ | |
| "dist/sith_${VERSION}_linux_amd64.sbom.sigstore.json" \ | |
| "dist/sith_${VERSION}_linux_arm64.sbom.sigstore.json" \ | |
| --clobber | |
| - name: Publish completed release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: gh release edit "$GITHUB_REF_NAME" --draft=false --latest |