.goreleaser.yaml

version: 2

release:
  # If set to auto, will mark the release as not ready for production in case there is an indicator for this in the
  # tag (e.g. v1.0.0-rc1). If set to true, will mark the release as not ready for production.
  prerelease: auto
  draft: false

builds:
  - id: linux-build
    dir: ./cmd/chronicle
    binary: chronicle
    goos:
      - linux
    goarch:
      - amd64
      - arm64
      - ppc64le
      - s390x
    # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
    ldflags: &build-ldflags |
      -w
      -s
      -extldflags '-static'
      -X main.version={{.Version}}
      -X main.gitCommit={{.Commit}}
      -X main.buildDate={{.Date}}
      -X main.gitDescription={{.Summary}}

  - id: darwin-build
    dir: ./cmd/chronicle
    binary: chronicle
    goos:
      - darwin
    goarch:
      - amd64
      - arm64
    mod_timestamp: *build-timestamp
    ldflags: *build-ldflags
    hooks:
      post:
        - cmd: .tool/quill sign-and-notarize "{{ .Path }}" --dry-run={{ .IsSnapshot }} --ad-hoc={{ .IsSnapshot }} -vv
          env:
            - QUILL_LOG_FILE=/tmp/quill-{{ .Target }}.log

  - id: windows-build
    dir: ./cmd/chronicle
    binary: chronicle
    goos: [windows]
    goarch: [amd64]
    mod_timestamp: *build-timestamp
    ldflags: *build-ldflags


nfpms:
  - vendor: "anchore"
    homepage: "https://github.com/anchore/chronicle"
    maintainer: "Alex Goodman <alex.goodman@anchore.com>"
    description: "A fast changelog generator sourced from PRs and Issues"
    license: "Apache-2.0"
    formats:
      - deb
      - rpm

archives:
  - id: linux-archives
    ids: [linux-build]
  - id: darwin-archives
    ids: [darwin-build]
  - id: windows-archives
    formats:
      - zip
    ids: [windows-build]

sboms:
  - artifacts: archive
    # this is relative to the snapshot/dist directory, not the root of the repo
    cmd: ../.tool/syft
    documents:
      - "{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom"
    args:
      - "scan"
      - "$artifact"
      - "--output"
      - "json=$document"

signs:
  - cmd: .tool/cosign
    signature: "${artifact}.sig"
    certificate: "${artifact}.pem"
    args:
      - "sign-blob"
      - "--use-signing-config=false"
      - "--oidc-issuer=https://token.actions.githubusercontent.com"
      - "--output-certificate=${certificate}"
      - "--output-signature=${signature}"
      - "${artifact}"
      - "--yes"
    artifacts: checksum