Document lockfile detection priority in README (#25) #5

	name: Release

	on:
	push:
	tags:
	- 'v*'

	permissions:
	contents: write
	id-token: write # Sigstore keyless signing

	jobs:
	release:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- uses: actions/setup-go@v5
	with:
	go-version: '1.23'

	- name: Run tests
	run: make test

	# GoReleaser builds cross-platform binaries and creates the GitHub release
	- uses: goreleaser/goreleaser-action@v6
	with:
	version: '~> v2'
	args: release --clean
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}

	# Dogfood: full pipeline against reference project + sign the binary
	- name: Build forgeseal for dogfooding
	run: make build

	- name: Run full pipeline on reference project
	run: \|
	./bin/forgeseal pipeline \
	--dir ./examples/hono-app \
	--output-dir ./forgeseal-output \
	--sign \
	--attest \
	--vex-triage

	- name: Sign forgeseal binary
	run: \|
	./bin/forgeseal sign \
	--artifact ./bin/forgeseal \
	--bundle ./forgeseal-output/forgeseal.sigstore.json

	- name: Attest forgeseal binary
	run: \|
	./bin/forgeseal attest \
	--subject ./bin/forgeseal \
	--sign \
	-o ./forgeseal-output/forgeseal.intoto.jsonl

	- name: Upload supply chain artifacts
	uses: actions/upload-artifact@v4
	with:
	name: forgeseal-supply-chain
	path: ./forgeseal-output/

	# Attach all artifacts to the GitHub release
	- name: Attach artifacts to release
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	tag="${GITHUB_REF#refs/tags/}"
	for f in ./forgeseal-output/*; do
	gh release upload "$tag" "$f" --clobber
	done

Navigation Menu