release: publish a GHCR container image (ghcr.io/sns45/forgeseal) via… #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| permissions: | |
| contents: write | |
| packages: write # push the container image to GHCR | |
| id-token: write # Sigstore keyless signing | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.23' | |
| - name: Run tests | |
| run: make test | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # GoReleaser builds cross-platform binaries, the container image, and the GitHub release | |
| - uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| version: '~> v2' | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }} | |
| # Dogfood: full pipeline against reference project + sign the binary | |
| - name: Build forgeseal for dogfooding | |
| run: make build | |
| - name: Run full pipeline on reference project | |
| run: | | |
| ./bin/forgeseal pipeline \ | |
| --dir ./examples/hono-app \ | |
| --output-dir ./forgeseal-output \ | |
| --sign \ | |
| --attest \ | |
| --vex-triage | |
| - name: Sign forgeseal binary | |
| run: | | |
| ./bin/forgeseal sign \ | |
| --artifact ./bin/forgeseal \ | |
| --bundle ./forgeseal-output/forgeseal.sigstore.json | |
| - name: Attest forgeseal binary | |
| run: | | |
| ./bin/forgeseal attest \ | |
| --subject ./bin/forgeseal \ | |
| --sign \ | |
| -o ./forgeseal-output/forgeseal.intoto.jsonl | |
| - name: Upload supply chain artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: forgeseal-supply-chain | |
| path: ./forgeseal-output/ | |
| # Attach all artifacts to the GitHub release | |
| - name: Attach artifacts to release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| tag="${GITHUB_REF#refs/tags/}" | |
| for f in ./forgeseal-output/*; do | |
| gh release upload "$tag" "$f" --clobber | |
| done |