glx/.goreleaser.yml at main · genealogix/glx · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
version: 2

before:
  hooks:
    - go mod verify
builds:
  - env:
      - CGO_ENABLED=0
    goos:
      - linux
      - windows
      - darwin
    goarch:
      - amd64
      - arm64
    binary: glx
    main: ./glx
    flags:
      - -trimpath
    ldflags:
      - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}}
    mod_timestamp: "{{ .CommitTimestamp }}"
archives:
  - formats: [tar.gz]
    name_template: >-
      {{ .ProjectName }}_
      {{- title .Os }}_
      {{- if eq .Arch "amd64" }}x86_64
      {{- else if eq .Arch "386" }}i386
      {{- else }}{{ .Arch }}{{ end }}
      {{- if .Arm }}v{{ .Arm }}{{ end }}
    format_overrides:
      - goos: windows
        formats: [zip]
    files:
      - LICENSE
      - NOTICE
      - README.md
      - CHANGELOG.md
sboms:
  # One SPDX-JSON SBOM per release archive, named `<archive>.sbom.json` by the
  # default document template. syft is NOT preinstalled on ubuntu-latest —
  # release.yml installs it with anchore/sbom-action/download-syft before the
  # GoReleaser step, and `make release-snapshot` needs it on PATH locally too.
  #
  # The SBOM pipe runs before the checksum pipe and SBOMs are a release-
  # uploadable artifact type, so every `.sbom.json` is listed in checksums.txt
  # automatically — which is what puts them under the existing cosign keyless
  # signature and the SLSA attestation, both of which take that manifest as
  # their subject. Do NOT also add them via `checksum.extra_files`: that
  # double-lists each SBOM in the signed manifest (verified on v2.18.2).
  #
  # args are pinned explicitly rather than inherited, to drop the `--enrich all`
  # in GoReleaser's default: enrichment pulls package metadata from online
  # sources at build time, which would let a third-party service feed content
  # into an artifact this repo signs inside the privileged (id-token: write)
  # release job, and would make the SBOM's contents depend on what those
  # services happened to return rather than on the tagged source alone. (#269)
  #
  # Dropping enrichment does NOT make the SBOM byte-reproducible, and no syft
  # flag here can: syft's SPDX output embeds a random `documentNamespace` UUID
  # and a `created` wall-clock timestamp, so two builds of the same tag emit
  # different SBOM bytes and therefore different `.sbom.json` lines in
  # checksums.txt. The archives themselves still reproduce byte-for-byte
  # (#1049) - a rebuild-and-compare audit has to compare the archive lines,
  # not the whole manifest. That limit is stated under "SBOM verification
  # details" in SECURITY-POSTURE.md; do not re-describe this stanza as making
  # the SBOM reproducible.
  - artifacts: archive
    args:
      - "$artifact"
      - "--output"
      - "spdx-json=$document"
checksum:
  name_template: 'checksums.txt'
release:
  # auto marks -alpha/-beta/-rc tags as GitHub pre-releases, keeping them out
  # of /releases/latest and the "Latest" badge. Without this, GoReleaser's
  # default (false) published every beta as a full release (#1007).
  prerelease: auto
signs:
  - cmd: cosign
    artifacts: checksum
    signature: "${artifact}.sigstore.json"
    args:
      - "sign-blob"
      - "--bundle=${signature}"
      - "${artifact}"
      - "--yes"
snapshot:
  version_template: "{{ incpatch .Version }}-next"
changelog:
  sort: asc
  filters:
    exclude:
      - '^docs:'
      - '^test:'