5701963045
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Bryan Beverly <[email protected]>
97 lines
3.8 KiB
YAML
97 lines
3.8 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- v*
|
|
|
|
permissions:
|
|
contents: write
|
|
packages: write
|
|
id-token: write
|
|
|
|
jobs:
|
|
Release:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
DOCKER_CLI_EXPERIMENTAL: "enabled"
|
|
steps:
|
|
# Setup steps - no external side effects.
|
|
- name: Checkout
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4
|
|
- name: Docker Login to DockerHub
|
|
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
- name: Docker Login to GitHub Container Registry
|
|
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.repository_owner }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: Set up Go
|
|
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
|
|
with:
|
|
go-version: "1.27"
|
|
- name: Cosign install
|
|
uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
|
|
- name: Install UPX
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y upx
|
|
|
|
# GoReleaser pipeline (sequential, not atomic):
|
|
# 1. build + archive + checksum + sign (local only, no side effects)
|
|
# 2. homebrew tap update (commit to trufflesecurity/homebrew-trufflehog)
|
|
# 3. docker images + manifests (DockerHub + GHCR, including :latest tags)
|
|
# 4. github release creation (artifacts uploaded, make_latest: false)
|
|
#
|
|
# On failure: GoReleaser does not roll back completed phases. Depending
|
|
# on where it failed, some subset of the above may have been published.
|
|
# Check:
|
|
# - Homebrew tap: https://github.com/trufflesecurity/homebrew-trufflehog
|
|
# - DockerHub: https://hub.docker.com/r/trufflesecurity/trufflehog/tags
|
|
# - GHCR: https://github.com/trufflesecurity/trufflehog/pkgs/container/trufflehog
|
|
# - GH releases: https://github.com/trufflesecurity/trufflehog/releases
|
|
#
|
|
# If the GitHub release was created but artifacts are missing, the
|
|
# install script (scripts/install.sh) will fail for users on that
|
|
# version. The release is NOT marked latest (make_latest: false), so
|
|
# /releases/latest still points to the previous good release.
|
|
- name: Run GoReleaser
|
|
uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
|
|
with:
|
|
distribution: goreleaser-pro
|
|
version: latest
|
|
args: release --clean
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
|
|
GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
|
|
|
|
# Promotes the GitHub release to "latest" only after the Release job fully
|
|
# succeeds (including post-steps). At this point, all artifacts have been
|
|
# published: Docker images and :latest tags are live, the Homebrew tap is
|
|
# updated, binaries are attached to the GitHub release, and checksums are
|
|
# signed.
|
|
#
|
|
# If this job fails, the release exists with all artifacts but is not flagged
|
|
# as latest. /releases/latest and scripts/install.sh still point to the
|
|
# previous release. To manually promote:
|
|
# gh release edit <tag> --latest --repo trufflesecurity/trufflehog
|
|
mark-latest:
|
|
needs: Release
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Mark release as latest
|
|
run: gh release edit "$TAG" --latest
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG: ${{ github.ref_name }}
|