release.yml

# Creates a GitHub Release.
# Workflow is manually run.
# Preselect branch or tag before running this workflow.
name: release

on:
  workflow_dispatch:
    inputs:
      prerelease:
        description: "Mark this release as a prerelease"
        required: false
        default: "auto"
        type: choice
        # auto follows semver. Prerelease versions are hyphenated with a label. ex. 0.0.0-alpha, 1.0.0-rc1
        options:
          - auto
          - "true"
          - "false"
      make-latest:
        description: "Latest release"
        required: false
        default: true
        type: boolean

permissions:
  contents: write
  id-token: write
  packages: write

jobs:
  release:
    runs-on: ubuntu-latest
    env:
      DOCKER_CLI_EXPERIMENTAL: "enabled"
    strategy:
      matrix:
        release_os:
          - linux
          - darwin
          - freebsd
          - illumos
          - netbsd
          - openbsd
          - windows
    steps:
      - name: Checkout
        uses: actions/checkout@v4.1.7
        with:
          fetch-depth: 0 # Required by GoRelease

      - name: Golang Setup
        uses: ./.github/actions/set-up-go

      - name: go-check
        run: go version

      # Supports syft/sbom generation
      - uses: anchore/sbom-action/download-syft@v0

        # Supports Buildx
      - name: Qemu Setup
        uses: docker/setup-qemu-action@v3

      - name: Buildx Setup
        uses: docker/setup-buildx-action@v3

      - name: Cosign Install
        uses: sigstore/cosign-installer@v3

      - name: GPG Import
        id: gpg-import
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSWORD }}

      - name: Cache Setup
        uses: actions/cache@v4
        with:
          path: |
            ./dist/**/bao
            ./dist/**/*.exe
            ./dist/**/*.deb
            ./dist/**/*.rpm
            ./dist/*.tar.gz
            ./dist/*.tar.gz.zst
            ./dist/*.zip
          key: ${{ github.ref }}

      - name: "Docker Login: ghcr.io"
        if: startsWith(github.ref, 'refs/tags/')
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: "Docker Login: docker.io"
        if: startsWith(github.ref, 'refs/tags/')
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}

      - name: "Docker Login: quay.io"
        if: startsWith(github.ref, 'refs/tags/')
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_TOKEN }}

        # Needed for nPFM
      - name: Create GPG Signing Key File
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          GPG_KEY_FILE=/tmp/signing-key.gpg
          echo "${{ secrets.GPG_PRIVATE_KEY_BASE64 }}" | base64 -di > "${GPG_KEY_FILE}"
          echo "GPG_KEY_FILE=${GPG_KEY_FILE}" >> "${GITHUB_ENV}"
        env:
          GPG_TTY: /dev/ttys000 # Set the GPG_TTY to avoid issues with pinentry

      - name: "Template GoRelaser configuration"
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          sed "s/REPLACE_WITH_RELEASE_GOOS/${{ matrix.release_os }}/g" .goreleaser-template.yaml > .goreleaser.yaml
          sed -i "s/^#OTHERARCH#//g" .goreleaser.yaml
          [ "${{ matrix.release_os }}" == "linux" ] && sed -i "s/^#LINUXONLY#//g" .goreleaser.yaml || true

      - name: "GoReleaser: Release"
        if: startsWith(github.ref, 'refs/tags/')
        uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: latest
          args: release --clean --timeout=60m --verbose --parallelism 2
        env:
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GPG_FINGERPRINT: ${{ steps.gpg-import.outputs.fingerprint }}
          GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          GITHUB_RELEASE_PRERELEASE: ${{ inputs.prerelease }}
          GITHUB_RELEASE_MAKE_LATEST: ${{ inputs.make-latest }}
          NFPM_DEFAULT_PASSPHRASE: ${{ secrets.GPG_PASSWORD }}

      - name: Remove GPG Signing Key File
        if: always()
        run: |
          if [ -n "${GPG_KEY_FILE}" ]; then
            rm -rf "${GPG_KEY_FILE}"
          fi

      - name: "Check free space on runner"
        run: |
          df -h .