score-compose/.github/workflows/release.yaml at main · score-spec/score-compose · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
name: release
on:
  push:
    tags:
      - 0.**
permissions:
  contents: read
jobs:
  release-go-binary:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      packages: write
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - name: Fetch all tags
        run: git fetch --force --tags
      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: 'go.mod'
      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        with:
          distribution: goreleaser
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
  release-container-image:
    uses: docker/github-builder/.github/workflows/build.yml@073833262a23a17675c95c4541ab063b7646756b # v1.9.0
    permissions:
      id-token: write # to sign attestation(s) with GitHub OIDC Token
      packages: write # to push container image to ghcr
    with:
      output: image
      push: true
      platforms: linux/amd64,linux/arm64
      sbom: true
      cache: true
      context: .
      set-meta-labels: true
      set-meta-annotations: true
      build-args: |
        "VERSION=${{ github.ref_name }}"
        "GIT_COMMIT=${{ github.sha }}"
        "BUILD_DATE=${{ github.event.head_commit.timestamp }}"
      meta-images: |
        ghcr.io/score-spec/score-compose
        scorespec/score-compose
      meta-tags: |
        type=ref,event=tag
        latest
    secrets:
      registry-auths: |
        - registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
        - username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_RELEASE_TOKEN }}