Merge pull request #1869 from entireio/delete-tokens-on-logout #164
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: publish-git-remote-entire | |
| # Publishes git-remote-entire (linux amd64/arm64 tarballs) to the public | |
| # release bucket on every push to main, keyed by commit sha. Consumed by | |
| # the entire-core-auth Buildkite plugin, whose environment hook installs | |
| # a pinned sha on hosted agents so `git clone entire://…` resolves. | |
| # See .goreleaser.nonprod.yaml for the artifact layout. | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # Required to mint the OIDC token that assume-role exchanges for AWS | |
| # credentials. | |
| id-token: write | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| # GoReleaser refuses to run untagged. The tag is local to the | |
| # runner, never pushed, and deliberately not stamped into the | |
| # binary (see the ldflags note in .goreleaser.nonprod.yaml). | |
| - name: Make a throwaway tag | |
| run: git tag --force v0.0.0 | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 | |
| with: | |
| role-to-assume: arn:aws:iam::128096325110:role/github-actions-public-release-upload | |
| aws-region: us-east-2 | |
| - name: Run GoReleaser | |
| uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7 | |
| with: | |
| distribution: goreleaser | |
| version: "~> v2" | |
| args: -f .goreleaser.nonprod.yaml release --clean --skip=validate | |
| env: | |
| GORELEASER_CURRENT_TAG: v0.0.0 |