release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    permissions:
      contents: write       # release upload + Homebrew tap push (with PAT)
      id-token: write       # cosign keyless signing via GitHub OIDC
      attestations: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          # Full history is required for the changelog generator.
          fetch-depth: 0

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version: stable
          cache: true

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
        with:
          cosign-release: 'v2.5.0'

      - name: Install syft (for SBOM generation)
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0

      - uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8  # v7.2.1
        with:
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # HOMEBREW_TAP_GITHUB_TOKEN must be a fine-grained PAT with
          # contents:write on <user>/homebrew-tap. Configure as a repo
          # secret before the first tagged release.
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}