release.yml

# Copyright (c) 2024 Joshua Sing <joshua@joshuasing.dev>
# Use of this source code is governed by the MIT License,
# which can be found in the LICENSE file.

# GitHub Actions workflow to create releases using GoReleaser.
name: "Release"

on:
  push:
    tags: [ "v*.*.*" ]

env:
  GO_VERSION: "1.23.x"

jobs:
  release:
    name: "Release"
    runs-on: "ubuntu-latest"
    environment:
      name: "release"
    permissions:
      contents: write
      id-token: write
      packages: write
      attestations: write
    env:
      DOCKER_CLI_EXPERIMENTAL: enabled
    steps:
      - name: "Checkout repository"
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: "Setup Go ${{ env.GO_VERSION }}"
        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version: "${{ env.GO_VERSION }}"
          cache: true
          check-latest: true

      - name: "Install cosign"
        uses: sigstore/cosign-installer@1aa8e0f2454b781fbf0fbf306a4c9533a0c57409 # v3.7.0

      - name: "Install Syft"
        uses: anchore/sbom-action/download-syft@251a468eed47e5082b105c3ba6ee500c0e65a764 # v0.17.6

      - name: "Setup QEMU"
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0

      - name: "Setup Docker Buildx"
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      - name: "Login to DockerHub"
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          username: "${{ secrets.DOCKERHUB_USERNAME }}"
          password: "${{ secrets.DOCKERHUB_TOKEN }}"

      - name: "Login to GitHub Container Registry"
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: "ghcr.io"
          username: "${{ github.repository_owner }}"
          password: "${{ secrets.GITHUB_TOKEN }}"

      - name: "Release"
        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
        with:
          args: "release --clean"
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

      - name: "Attest release artifacts"
        uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0
        with:
          subject-path: |
            dist/**/starlink_exporter
            dist/*.tar.gz
            dist/*.zip
            dist/*.txt
            dist/*.pem
            dist/*.sig