release.yaml

name: release
on:
  push:
    tags:
      - 0.**
permissions:
  contents: read
jobs:
  release-go-binary:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      packages: write
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Fetch all tags
        run: git fetch --force --tags
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: 'go.mod'
      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          distribution: goreleaser
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
  release-container-image:
    uses: docker/github-builder/.github/workflows/build.yml@27ade872c1e2296e62ef15ab3b10d37665e57cf7 # main
    permissions:
      id-token: write # to sign attestation(s) with GitHub OIDC Token
      packages: write # to push container image to ghcr
    with:
      output: image
      push: true
      platforms: linux/amd64,linux/arm64
      sbom: true
      cache: true
      context: .
      set-meta-labels: true
      set-meta-annotations: true
      build-args: |
        "VERSION=${{ github.ref_name }}"
        "GIT_COMMIT=${{ github.sha }}"
        "BUILD_DATE=${{ github.event.head_commit.timestamp }}"
      meta-images: |
        ghcr.io/${{ github.repository }}
        ${{ vars.DOCKER_HUB_ORG }}/score-compose
      meta-tags: |
        type=ref,event=tag
        latest
      registry-identities: |
        - type: dockerhub
          registry: docker.io
          username: ${{ vars.DOCKER_HUB_ORG }}
          connection_id: ${{ vars.DOCKER_HUB_OIDC_CONNECTION_ID }}
    secrets:
      registry-auths: |
        - registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}