.goreleaser.yaml

# SPDX-FileCopyrightText: Copyright 2024 The Minder Authors
# SPDX-License-Identifier: Apache-2.0

# This is an example .goreleaser.yml file with some sensible defaults.
# Make sure to check the documentation at https://goreleaser.com

# The lines bellow are called `modelines`. See `:help modeline`
# Feel free to remove those if you don't want/need to use them.
# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
# vim: set ts=2 sw=2 tw=0 fo=cnqoj
project_name: minder
version: 2
before:
  hooks:
    - go mod tidy
    - make generate-tools
    - go generate ./...
# This section defines the build matrix.
builds:
  - env:
      - GO111MODULE=on
      - CGO_ENABLED=0
    flags:
      - -trimpath
      - -tags=netgo
    ldflags:
      - "-X main.Version={{ .Env.VERSION }}"
      - "-X main.Commit={{ .Env.COMMIT }}"
      - "-X main.CommitDate={{ .Env.COMMIT_DATE }}"
      - "-X main.TreeState={{ .Env.TREE_STATE }}"
      - "-X github.com/mindersec/minder/internal/constants.CLIVersion={{ .Env.VERSION }}"
    goos:
      - linux
      - windows
      - darwin
    goarch:
      - amd64
      - arm64
    main: ./cmd/cli
# This section defines the release format.
archives:
  - format: tar.gz # we can use binary, but it seems there's an issue where goreleaser skips the sboms
    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}" # "{{ .Binary }}-{{ .Os }}-{{ .Arch }}"
    format_overrides:
      - goos: windows
        format: zip
# This section defines how to release to winget.
winget:
  - name: minder
    publisher: mindersec
    license: Apache-2.0
    license_url: "https://github.com/mindersec/minder/blob/main/LICENSE"
    copyright: Minder
    homepage: https://mindersec.github.io/
    short_description: 'minder is the client CLI for interacting with Minder'
    publisher_support_url: "https://github.com/mindersec/minder/issues/new/choose"
    package_identifier: "mindersec.minder"
    url_template: "https://github.com/mindersec/minder/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
    skip_upload: auto
    release_notes: "{{.Changelog}}"
    tags:
      - golang
      - cli
    commit_author:
      name: stacklokbot
      email: info@stacklok.com
    goamd64: v1
    repository:
      owner: mindersec
      name: winget-pkgs
      branch: "minder-{{.Version}}"
      token: "{{ .Env.WINGET_GITHUB_TOKEN }}"
      pull_request:
        enabled: true
        draft: false
        base:
          owner: microsoft
          name: winget-pkgs
          branch: master
# This section defines whether we want to release the source code too.
source:
  enabled: true
# This section defines how to generate the changelog
changelog:
  sort: asc
  use: github
# This section defines for which artifact types to generate SBOMs.
sboms:
  - artifacts: archive
# This section defines the release policy.
release:
  # If set to auto, will mark the release as not ready for production
  # in case there is an indicator for this in the tag e.g. v1.0.0-rc1
  prerelease: auto
  github:
    owner: mindersec
    name: minder
# This section defines how and which artifacts we want to sign for the release.
signs:
  - cmd: cosign
    args:
      - "sign-blob"
      - "--output-signature=${signature}"
      - "--output-certificate=${certificate}"
      - "${artifact}"
      - "--yes" # needed on cosign 2.0.0+
    artifacts: archive
    output: true
    # It looks like this may default to empty-string, and we need to set it to upload
    # the sigstore certs
    certificate: '{{ trimsuffix (trimsuffix .Env.artifact ".zip") ".tar.gz" }}.pem'