paranoia/.github/workflows/release.yaml at 44a61fbd94505fa73c6572138ce53c7b94b58846 · jetstack/paranoia · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
name: Release

on:
  push:
    tags:
      - "v*.*.*"

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        os: [ linux, darwin ]
        arch: [ amd64, arm64 ]
    steps:
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: 1.23.x
      - uses: actions/checkout@v4
      - name: Go Build
        run: CGO_ENABLED=0 GOOS=${{ matrix.os }} GOARCH=${{ matrix.arch }} go build -a -installsuffix cgo -o paranoia .
      - uses: actions/upload-artifact@v4
        with:
          name: paranoia-${{ matrix.os }}-${{ matrix.arch }}
          path: paranoia

  docs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Documentation Build
        run: go run ./hack/generate-manual
      - uses: actions/upload-artifact@v4
        with:
          name: man-pages
          path: man/

  release:
    needs:
      - build
    runs-on: ubuntu-latest
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v6
      - name: Rename Artifacts
        run: |
          mkdir bin
          mv paranoia-darwin-amd64/paranoia bin/paranoia-darwin-amd64
          mv paranoia-darwin-arm64/paranoia bin/paranoia-darwin-arm64
          mv paranoia-linux-amd64/paranoia bin/paranoia-linux-amd64
          mv paranoia-linux-arm64/paranoia bin/paranoia-linux-arm64
          mkdir man
          mv man-pages/* man/
      - name: Generate hashes
        shell: bash
        id: hash
        run: |
          echo "hashes=$(sha256sum bin/paranoia-darwin-amd64 bin/paranoia-darwin-arm64 bin/paranoia-linux-amd64 bin/paranoia-linux-arm64 | base64 -w0)" >> "$GITHUB_OUTPUT"
      - name: Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            LICENSE.txt
            bin/paranoia-*
            man/*

  provenance-for-binaries:
    needs:
      - release
    permissions:
      actions: read # Needed for detection of GitHub Actions environment.
      id-token: write # Needed for provenance signing and ID.
      contents: write # Needed for release uploads.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: "${{ needs.release.outputs.hashes }}"