.goreleaser.yml

---
version: 2
before:
  hooks:
    - go mod download
    - ./scripts/completions.sh

builds:
  - id: pv-migrate
    main: ./cmd/pv-migrate
    binary: pv-migrate
    # reproducible: no build paths in the binary, and the commit time as the
    # file and build timestamp, so the same commit yields the same bytes.
    # goreleaser's default ldflags are spelled out here because they stamp
    # the build time into the binary, and setting ldflags at all replaces
    # them, so the ones the binary reads have to be kept explicitly
    flags:
      - -trimpath
    mod_timestamp: "{{ .CommitTimestamp }}"
    ldflags:
      - -s -w
      - -X main.version={{ .Version }}
      - -X main.commit={{ .Commit }}
      - -X main.date={{ .CommitDate }}
    env:
      - CGO_ENABLED=0
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm
      - arm64
    goarm:
     - "7"
    ignore:
      - goos: windows
        goarch: arm
      - goos: windows
        goarch: arm64
      - goos: darwin
        goarch: arm

archives:
  - id: pv-migrate-archive
    # default name template except we use .Tag instead of .Version to keep the "v" prefix
    name_template: >-
      {{ .ProjectName }}_
      {{- .Tag }}_
      {{- .Os }}_
      {{- if eq .Arch "amd64" }}x86_64
      {{- else if eq .Arch "386" }}i386
      {{- else }}{{ .Arch }}{{ end }}
      {{- with .Arm }}v{{ . }}{{ end }}
      {{- with .Mips }}_{{ . }}{{ end }}
      {{- if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}
    ids:
      - pv-migrate
    format_overrides:
      - goos: windows
        formats:
          - zip
    # every entry gets a fixed owner and mode, and the extra files the commit
    # time: the archive entries would otherwise carry the builder's uid, gid
    # and user name, the file mode the umask produced, and the checkout time
    # of the license and the build time of the generated completions, so the
    # archives would reproduce only on the same machine. The binaries get
    # their mode (0755) from goreleaser and their time from mod_timestamp
    builds_info:
      owner: root
      group: root
    files:
      - src: LICENSE
        info:
          owner: root
          group: root
          mode: 0644
          mtime: "{{ .CommitDate }}"
      - src: completions/*
        info:
          owner: root
          group: root
          mode: 0644
          mtime: "{{ .CommitDate }}"

checksum:
  name_template: checksums.txt
  algorithm: sha256

# One keyless cosign signature over checksums.txt covers every archive, since
# the file lists their sha256 sums. The bundle carries the signature and the
# short-lived certificate, which names the release workflow as the signer, so
# there is no key to store or rotate. Signing is skipped in the snapshot and
# rebuild jobs, which have no OIDC identity to sign with.
signs:
  - id: checksums
    cmd: cosign
    artifacts: checksum
    signature: "${artifact}.sigstore.json"
    args:
      - sign-blob
      - --yes
      - --bundle=${signature}
      - ${artifact}

git:
  ignore_tags: # skip prereleases (alpha, beta, rc) on finding previous commit to generate the changelog
    - "*-*"

changelog:
  sort: asc
  groups:
    - title: "New Features"
      regexp: '^feat(\(.+\))?:'
      order: 0
    - title: "Bug Fixes"
      regexp: '^fix(\(.+\))?:'
      order: 1
    - title: "Performance Improvements"
      regexp: '^perf(\(.+\))?:'
      order: 2
    - title: "Documentation"
      regexp: '^docs(\(.+\))?:'
      order: 3
    - title: "Refactors & Internal Changes"
      regexp: '^refactor(\(.+\))?:'
      order: 4
    - title: "Dependency Updates"
      regexp: '^chore\(deps\):'
      order: 5
    - title: "Build, CI & Chores"
      regexp: '^(build|ci|cd|cicd|docker|test|chore)(\(.+\))?:'
      order: 6
    - title: "Other Changes"
      order: 999
  filters:
    exclude:
      - Merge pull request
      - Merge branch
      - go mod tidy

dockers_v2:
  - images:
      - docker.io/utkuozdemir/pv-migrate
      - ghcr.io/utkuozdemir/pv-migrate
    tags:
      - "{{ .Tag }}"
      - "{{ if not .Prerelease }}latest{{ end }}"
    platforms:
      - linux/amd64
      - linux/arm64
      - linux/arm/v7
    # reproducible image: the commit time as the image and history timestamp
    # (buildkit reads it from this build argument), and the exporter rewrites
    # the layer timestamps to it, which the COPY of the binary otherwise
    # stamps with the build time. The exporter option only applies to the
    # pushed release image: a snapshot loads a multi-platform build into the
    # daemon, which cannot carry it, so snapshot images stay non-reproducible.
    # buildkit's own provenance and SBOM attestations carry wall-clock times
    # and change the published index digest on every build, so they are off.
    # The release workflow attaches GitHub's build provenance instead.
    sbom: false
    build_args:
      SOURCE_DATE_EPOCH: "{{ .CommitTimestamp }}"
    flags:
      - "{{ if not .IsSnapshot }}--output=type=image,rewrite-timestamp=true,push=true{{ end }}"
      - "{{ if not .IsSnapshot }}--provenance=false{{ end }}"

release:
  prerelease: auto

# homebrew_casks replaces the deprecated "brews" config (hard-deprecated in
# goreleaser v2.16, removed in v3). Casks now work on Linux too since
# Homebrew/brew#19121, and existing "brew install pv-migrate" users are
# auto-migrated to the cask via tap_migrations.json in the tap repo.
homebrew_casks:
  - repository:
      owner: utkuozdemir
      name: homebrew-pv-migrate
      token: "{{ .Env.PRIVATE_ACCESS_TOKEN }}"
    skip_upload: auto
    commit_author:
      name: Utku Ozdemir
      email: utkuozdemir@gmail.com
    directory: Casks
    homepage: https://github.com/utkuozdemir/pv-migrate
    description: Persistent volume migration plugin for Kubernetes
    completions:
      bash: completions/pv-migrate.bash
      zsh: completions/pv-migrate.zsh
      fish: completions/pv-migrate.fish
    # pv-migrate binaries are not code-signed/notarized, so strip the macOS
    # quarantine bit on install to avoid the "damaged and can't be opened" error.
    hooks:
      post:
        install: |
          if OS.mac?
            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/pv-migrate"]
          end

scoops:
  - repository:
      owner: utkuozdemir
      name: scoop-pv-migrate
      token: "{{ .Env.PRIVATE_ACCESS_TOKEN }}"
    skip_upload: auto
    commit_author:
      name: Utku Ozdemir
      email: utkuozdemir@gmail.com
    commit_msg_template: "Scoop update for {{ .ProjectName }} version {{ .Tag }}"
    homepage: https://github.com/utkuozdemir/pv-migrate
    description: Persistent volume migration plugin for Kubernetes
    license: Apache-2.0