Prepare action for GitHub Marketplace #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release-artifacts | |
| # Produces supply-chain artifacts for releases and main-branch snapshots: | |
| # - SBOM (CycloneDX JSON) generated by anchore/sbom-action via syft | |
| # - sha256 checksum file for the binary so consumers can verify downloads | |
| # - sigstore cosign keyless signature (OIDC) on tags | |
| # | |
| # Triggered on: | |
| # - Pushes to main (snapshot artifacts, not retained as a "release") | |
| # - Tag pushes matching v* (full release) | |
| # - workflow_dispatch (manual rerun) | |
| # | |
| # Security notes: | |
| # - Every github context value that ends up in a "run:" shell line is first | |
| # bound to an env variable on the step (the documented safe pattern | |
| # against workflow-injection). Untrusted contexts like commit messages | |
| # or PR titles are never referenced here. | |
| # - Actions are pinned to major version tags published by reputable orgs; | |
| # we accept the standard GitHub-hosted runner trust boundary. | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| workflow_dispatch: | |
| permissions: | |
| contents: write # required to attach SBOM/release assets on tag builds | |
| id-token: write # cosign keyless signing | |
| packages: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| GO_VERSION: "1.25.11" | |
| jobs: | |
| build-and-sign: | |
| name: Build, SBOM, sign | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache: true | |
| - name: Resolve build metadata | |
| id: meta | |
| env: | |
| REF: ${{ github.ref }} | |
| run: | | |
| set -euo pipefail | |
| if [[ "$REF" == refs/tags/* ]]; then | |
| VERSION="${REF#refs/tags/}" | |
| else | |
| VERSION="$(git describe --tags --always --dirty)" | |
| fi | |
| COMMIT="$(git rev-parse --short=12 HEAD)" | |
| BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)" | |
| { | |
| echo "version=$VERSION" | |
| echo "commit=$COMMIT" | |
| echo "build_date=$BUILD_DATE" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Build bpfcompat | |
| env: | |
| VERSION: ${{ steps.meta.outputs.version }} | |
| COMMIT: ${{ steps.meta.outputs.commit }} | |
| BUILD_DATE: ${{ steps.meta.outputs.build_date }} | |
| run: | | |
| set -euo pipefail | |
| mkdir -p dist | |
| LDFLAGS="-X github.com/kernel-guard/bpfcompat/internal/version.Version=${VERSION} \ | |
| -X github.com/kernel-guard/bpfcompat/internal/version.Commit=${COMMIT} \ | |
| -X github.com/kernel-guard/bpfcompat/internal/version.BuildDate=${BUILD_DATE}" | |
| go build -trimpath -ldflags "$LDFLAGS" -o dist/bpfcompat ./cmd/bpfcompat | |
| - name: Compute checksums | |
| run: | | |
| set -euo pipefail | |
| cd dist | |
| sha256sum bpfcompat > bpfcompat.sha256 | |
| - name: Generate SBOM (CycloneDX) | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| path: . | |
| format: cyclonedx-json | |
| output-file: dist/bpfcompat.sbom.cdx.json | |
| - name: Install cosign | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Sign binary + SBOM (tag releases only) | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| run: | | |
| set -euo pipefail | |
| cosign sign-blob --yes dist/bpfcompat --output-signature dist/bpfcompat.sig --output-certificate dist/bpfcompat.crt | |
| cosign sign-blob --yes dist/bpfcompat.sbom.cdx.json --output-signature dist/bpfcompat.sbom.cdx.sig --output-certificate dist/bpfcompat.sbom.cdx.crt | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: bpfcompat-release-${{ steps.meta.outputs.version }} | |
| path: | | |
| dist/bpfcompat | |
| dist/bpfcompat.sha256 | |
| dist/bpfcompat.sbom.cdx.json | |
| dist/bpfcompat.sig | |
| dist/bpfcompat.crt | |
| dist/bpfcompat.sbom.cdx.sig | |
| dist/bpfcompat.sbom.cdx.crt | |
| if-no-files-found: warn |