mirror of
https://github.com/goreleaser/goreleaser-action.git
synced 2026-05-14 06:40:32 +00:00
* feat: verify release checksum and cosign signature Download checksums.txt for the release and verify the SHA-256 of the downloaded archive against it. When cosign is available in PATH, also download checksums.txt.sigstore.json and verify the signature against the goreleaser/goreleaser-pro release workflow identity. Both steps degrade gracefully (with a warning) when the corresponding artifacts or tooling are missing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: use install() for checksum e2e tests Drop the http-client download helper from verifyChecksum integration tests; call goreleaser.install() instead so the test exercises the public API path and avoids duplicating download logic. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
253 lines
6.4 KiB
YAML
253 lines
6.4 KiB
YAML
name: ci
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 10 * * *'
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- 'master'
|
|
- 'releases/v*'
|
|
tags:
|
|
- 'v*'
|
|
pull_request:
|
|
|
|
jobs:
|
|
ci:
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os:
|
|
- ubuntu-latest
|
|
- macos-latest
|
|
- windows-latest
|
|
version:
|
|
- latest
|
|
- '~> 2.6'
|
|
- '~> 1.26'
|
|
distribution:
|
|
- goreleaser
|
|
- goreleaser-pro
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0
|
|
-
|
|
name: Set up Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version: stable
|
|
-
|
|
name: Check
|
|
uses: ./
|
|
with:
|
|
version: ${{ matrix.version }}
|
|
args: check --verbose
|
|
workdir: ./test
|
|
-
|
|
name: GoReleaser
|
|
if: ${{ !(github.event_name == 'pull_request' && matrix.distribution == 'goreleaser-pro') }}
|
|
uses: ./
|
|
env:
|
|
GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
|
|
with:
|
|
distribution: ${{ matrix.distribution }}
|
|
version: ${{ matrix.version }}
|
|
args: release --skip=publish --clean --snapshot
|
|
workdir: ./test
|
|
|
|
install-only:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
version:
|
|
- latest
|
|
- '~> 2.6'
|
|
- '~> 1.26'
|
|
distribution:
|
|
- goreleaser
|
|
- goreleaser-pro
|
|
cosign:
|
|
- true
|
|
- false
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0
|
|
-
|
|
name: Set up Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version: 1.18
|
|
-
|
|
name: Install cosign
|
|
if: matrix.cosign
|
|
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
|
|
-
|
|
name: GoReleaser
|
|
if: ${{ !(github.event_name == 'pull_request' && matrix.distribution == 'goreleaser-pro') }}
|
|
uses: ./
|
|
with:
|
|
distribution: ${{ matrix.distribution }}
|
|
version: ${{ matrix.version }}
|
|
install-only: true
|
|
-
|
|
name: Check
|
|
if: ${{ !(github.event_name == 'pull_request' && matrix.distribution == 'goreleaser-pro') }}
|
|
run: |
|
|
goreleaser check --verbose
|
|
|
|
signing:
|
|
runs-on: ${{ matrix.os }}
|
|
if: github.event_name != 'pull_request'
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os:
|
|
- ubuntu-latest
|
|
- macos-latest
|
|
- windows-latest
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0
|
|
-
|
|
name: Set up Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version: 1.18
|
|
-
|
|
name: Import GPG key
|
|
id: import_gpg
|
|
uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
|
|
with:
|
|
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY_TEST }}
|
|
passphrase: ${{ secrets.PASSPHRASE_TEST }}
|
|
-
|
|
name: Check
|
|
uses: ./
|
|
with:
|
|
version: latest
|
|
args: -f .goreleaser-signing.yml check --verbose
|
|
workdir: ./test
|
|
env:
|
|
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
|
|
-
|
|
name: GoReleaser
|
|
uses: ./
|
|
with:
|
|
version: latest
|
|
args: -f .goreleaser-signing.yml release --skip=publish --clean --snapshot
|
|
workdir: ./test
|
|
env:
|
|
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
|
|
|
|
upload-artifact:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0
|
|
-
|
|
name: Set up Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version: 1.18
|
|
-
|
|
name: Check
|
|
uses: ./
|
|
with:
|
|
args: check --verbose
|
|
workdir: ./test
|
|
-
|
|
name: GoReleaser
|
|
uses: ./
|
|
with:
|
|
args: release --skip=publish --clean --snapshot
|
|
workdir: ./test
|
|
-
|
|
name: Upload assets
|
|
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
|
with:
|
|
name: myapp
|
|
path: ./test/dist/*
|
|
|
|
dist:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0
|
|
-
|
|
name: Set up Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version: 1.18
|
|
-
|
|
name: GoReleaser
|
|
uses: ./
|
|
with:
|
|
args: release --config .goreleaser-dist.yml --skip=publish --clean --snapshot
|
|
workdir: ./test
|
|
-
|
|
name: Check dist
|
|
run: |
|
|
tree -nh ./test/_output
|
|
|
|
nightly:
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os:
|
|
- ubuntu-latest
|
|
- macos-latest
|
|
- windows-latest
|
|
distribution:
|
|
- goreleaser-pro
|
|
- goreleaser
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0
|
|
-
|
|
name: Set up Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version: 1.18
|
|
-
|
|
name: GoReleaser
|
|
uses: ./
|
|
with:
|
|
install-only: true
|
|
distribution: ${{ matrix.distribution }}
|
|
version: nightly
|
|
-
|
|
name: Check
|
|
run: |
|
|
goreleaser check -f ./test/.goreleaser.yml
|
|
goreleaser --version
|
|
goreleaser --version | grep nightly
|
|
|