guidecheck/.github/workflows/release.yml at main · snapsynapse/guidecheck · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
name: release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write       # upload release assets
  id-token: write       # Sigstore keyless OIDC

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Run local verification suite
        run: make test

      - name: Build release archive and conformance kit
        run: |
          make release-archive
          make conformance-kit

      - name: Compute combined SHA256SUMS
        working-directory: build
        run: |
          shasum -a 256 \
            guidecheck-[0-9]*.tar.gz \
            guidecheck-*.zip \
            guidecheck-conformance-kit-*.tar.gz \
            > SHA256SUMS

      - name: Install cosign
        uses: sigstore/cosign-installer@v3
        with:
          cosign-release: "v2.4.1"

      - name: Sign artifacts with Sigstore keyless
        working-directory: build
        env:
          COSIGN_EXPERIMENTAL: "1"
        run: |
          for artifact in \
            guidecheck-[0-9]*.tar.gz \
            guidecheck-*.zip \
            guidecheck-conformance-kit-*.tar.gz \
            SHA256SUMS; do
            cosign sign-blob --yes \
              --output-signature "${artifact}.sig" \
              --output-certificate "${artifact}.crt" \
              "${artifact}"
          done

      - name: Resolve release notes
        id: release-notes
        shell: bash
        run: echo "path=RELEASE_NOTES-${GITHUB_REF_NAME#v}.md" >> "$GITHUB_OUTPUT"

      - name: Upload release artifacts
        uses: softprops/action-gh-release@v2
        with:
          files: |
            build/guidecheck-[0-9]*.tar.gz
            build/guidecheck-*.zip
            build/guidecheck-conformance-kit-*.tar.gz
            build/SHA256SUMS
            build/*.sig
            build/*.crt
          body_path: ${{ steps.release-notes.outputs.path }}
          fail_on_unmatched_files: true