release.yaml

name: Release

on:
  workflow_dispatch: {}
  push:
    tags:
      - 'v*'

jobs:
  build-publish:
    name: "Build image and publish"
    timeout-minutes: 15
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: git fetch --prune --unshallow

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3.7.0
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64
      - name: Set up docker buildx
        uses: docker/setup-buildx-action@v3

      - name: Github registry login
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        timeout-minutes: 10
        run: make images
        env:
          PUSH: "true"
          TAG: "edge"
      - name: Sign images
        timeout-minutes: 4
        run: make images-cosign
        env:
          TAG: "edge"

      - name: Build and push
        timeout-minutes: 10
        run: make images
        env:
          PUSH: "true"
      - name: Sign images
        timeout-minutes: 4
        run: make images-cosign

  build-publish-cli:
    name: "Publish cli tool"
    timeout-minutes: 15
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Unshallow
        run: git fetch --prune --unshallow

      - name: Set up go
        timeout-minutes: 5
        uses: actions/setup-go@v5
        with:
          go-version-file: 'go.mod'

      - name: Generate token
        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
        id: token
        with:
          app-id: "${{ secrets.BOT_APP_ID }}"
          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
          owner: "${{ github.repository_owner }}"
          repositories: homebrew-tap
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TOKEN: ${{ steps.token.outputs.token }}