openframe-cli/.goreleaser.yml at main · flamingo-stack/openframe-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
version: 2

project_name: openframe-cli

before:
  hooks:
    - go mod tidy
    - go mod download

builds:
  - id: openframe-cli
    main: ./main.go
    binary: openframe
    env:
      - CGO_ENABLED=0
    goos:
      - linux
      - windows
      - darwin
    goarch:
      - amd64
      - arm64
    ldflags:
      # Target package-level string vars, NOT struct fields: `-X` cannot set a
      # struct field (it silently no-ops), which previously left every release
      # reporting "dev" and disabled self-update.
      - -s -w
      - -X github.com/flamingo-stack/openframe-cli/cmd.version={{.Version}}
      - -X github.com/flamingo-stack/openframe-cli/cmd.commit={{.Commit}}
      - -X github.com/flamingo-stack/openframe-cli/cmd.date={{.Date}}
    # Release-only code signing (macOS: codesign + notarytool; Windows: Azure
    # Trusted Signing). Must run before archiving so archives/checksums cover
    # the signed binaries. No-op unless OPENFRAME_SIGN=1 — see the script.
    hooks:
      post:
        - cmd: ./scripts/sign-binary.sh {{ .Os }} {{ .Arch }} "{{ .Path }}"
          output: true

archives:
  - id: openframe-cli-archive
    ids:
      - openframe-cli
    name_template: "openframe-cli_{{ .Os }}_{{ .Arch }}"
    formats: ["tar.gz"]
    format_overrides:
      - goos: windows
        formats: ["zip"]
    files:
      - README.md
    wrap_in_directory: false

checksum:
  name_template: 'checksums.txt'
  algorithm: sha256

# Software Bill of Materials, one per archive (generated with syft).
# Additive: publishes *_sbom.spdx.json alongside artifacts; binaries unchanged.
sboms:
  - id: archive
    artifacts: archive

# Keyless cosign signature of the checksums file (which covers every artifact
# via its SHA256). Emits a new-format Sigstore bundle (checksums.txt.bundle)
# carrying the signature, the Fulcio certificate, and the Rekor transparency-log
# entry in one file — this is what `openframe update` verifies (Phase 2) against
# the pinned GitHub Actions OIDC identity. The binaries themselves are NOT
# modified and run identically with or without verification.
# Requires cosign >= 3.0 (where `--bundle` writes the new format by default; the
# old `--new-bundle-format` flag was removed) and `id-token: write` in the
# release workflow. cosign-installer installs the latest (v3.x) by default.
#
# Manual verification:
#   cosign verify-blob --bundle checksums.txt.bundle \
#     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
#     --certificate-identity-regexp '^https://github.com/flamingo-stack/openframe-cli/\.github/workflows/release\.yml@.*$' \
#     checksums.txt
signs:
  - cmd: cosign
    artifacts: checksum
    output: true
    signature: '${artifact}.bundle'
    args:
      - sign-blob
      - '--bundle=${signature}'
      - '${artifact}'
      - '--yes'

changelog:
  # github-native delegates note generation to GitHub's "Generate release notes"
  # API, which categorizes by PR LABEL via .github/release.yml — the right fit
  # for this repo's squash-merge + free-form PR titles. Under github-native
  # GoReleaser IGNORES its own `groups`/`filters`, so they are intentionally
  # absent here; edit .github/release.yml to change categories or exclusions.
  use: github-native
  sort: asc

release:
  make_latest: true
  draft: false
  prerelease: auto
  name_template: "🦩 {{ .Tag }}"