.goreleaser.yml

version: 2
project_name: spiffe-vault

before:
  hooks:
    - go mod tidy

env:
  - CGO_ENABLED=0

builds:
  - id: binary
    dir: cmd/spiffe-vault
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
    goarm:
      - "8"
    mod_timestamp: '{{ .CommitTimestamp }}'
    flags:
      - -trimpath
    ldflags:
      - "{{ .Env.LDFLAGS }}"

archives:
  - id: archive
    format: tar.gz
    files:
      - LICENSE*
      - README*
    format_overrides:
      - goos: windows
        format: zip

dockers:
  - goos: linux
    goarch: amd64
    image_templates:
      - "ghcr.io/philips-labs/{{ .ProjectName }}:v{{ .Version }}-amd64"
      - "ghcr.io/philips-labs/{{ .ProjectName }}:{{ .FullCommit }}-amd64"
    use: buildx
    build_flag_templates:
      - "--pull"
      - "--platform=linux/amd64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.title={{.ProjectName}}"
      - "--label=org.opencontainers.image.description={{.ProjectName}}"
      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Version}}"
      - "--label=org.opencontainers.image.licenses=MIT"
      - "--label=org.opencontainers.image.vendor=Koninklijke Philips N.V."
    extra_files:
      - "Makefile"
      - "go.mod"
      - "go.sum"
      - ".git"
      - ".gitignore"
      - "cmd"
      - "pkg"
  - goos: linux
    goarch: arm64
    image_templates:
      - "ghcr.io/philips-labs/{{ .ProjectName }}:v{{ .Version }}-arm64"
      - "ghcr.io/philips-labs/{{ .ProjectName }}:{{ .FullCommit }}-arm64"
    use: buildx
    build_flag_templates:
      - "--pull"
      - "--platform=linux/arm64"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.title={{.ProjectName}}"
      - "--label=org.opencontainers.image.description={{.ProjectName}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.source={{.GitURL}}"
      - "--label=org.opencontainers.image.version={{.Version}}"
      - "--label=org.opencontainers.image.licenses=MIT"
      - "--label=org.opencontainers.image.vendor=Koninklijke Philips N.V."
    extra_files:
      - "Makefile"
      - "go.mod"
      - "go.sum"
      - ".git"
      - ".gitignore"
      - "cmd"
      - "pkg"

docker_manifests:
  - name_template: 'ghcr.io/philips-labs/{{ .ProjectName }}:v{{ .Version }}'
    image_templates:
    - 'ghcr.io/philips-labs/{{ .ProjectName }}:v{{ .Version }}-amd64'
    - 'ghcr.io/philips-labs/{{ .ProjectName }}:v{{ .Version }}-arm64'
  - name_template: 'ghcr.io/philips-labs/{{ .ProjectName }}:{{ .FullCommit }}'
    image_templates:
    - 'ghcr.io/philips-labs/{{ .ProjectName }}:{{ .FullCommit }}-amd64'
    - 'ghcr.io/philips-labs/{{ .ProjectName }}:{{ .FullCommit }}-arm64'

checksum:
  name_template: 'checksums.txt'

signs:
  - id: checksums
    cmd: cosign
    stdin: '{{ .Env.COSIGN_PASSWORD }}'
    output: true
    artifacts: checksum
    args:
      - sign-blob
      - --key
      - cosign.key
      - '--output-certificate=${certificate}'
      - '--output-signature=${signature}'
      - '${artifact}'
      - --yes
  - id: binaries
    cmd: cosign
    stdin: '{{ .Env.COSIGN_PASSWORD }}'
    output: true
    artifacts: binary
    args:
      - sign-blob
      - --key
      - cosign.key
      - '--output-certificate=${certificate}'
      - '--output-signature=${signature}'
      - '${artifact}'
      - --yes
  - id: archives
    cmd: cosign
    stdin: '{{ .Env.COSIGN_PASSWORD }}'
    output: true
    artifacts: archive
    args:
      - sign-blob
      - --key
      - cosign.key
      - '--output-certificate=${certificate}'
      - '--output-signature=${signature}'
      - '${artifact}'
      - --yes

docker_signs:
  - artifacts: all
    cmd: cosign
    stdin: '{{ .Env.COSIGN_PASSWORD }}'
    output: true
    args:
      - 'sign'
      - --key
      - cosign.key
      - '${artifact}@${digest}'
      - --yes

snapshot:
  name_template: "{{ .Version }}-next"

changelog:
  sort: asc
  use: github
  filters:
    exclude:
      - '^docs:'
      - '^test:'
      - Merge pull request
      - Merge branch
  groups:
    - title: 'Other changes'
      order: 0
    - title: Version Bumps
      regexp: "^Bump .*$"
      order: 10

release:
  prerelease: auto
  extra_files:
    - glob: ./cosign.pub
    - glob: dist/*.sig
  footer: |
    **Full Changelog**: https://github.com/philips-labs/slsa-provenance-action/compare/{{ .PreviousTag }}...{{ .Tag }}