Updated dependencies #14
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Adapted from Caddy's release process. | |
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*.*.*' | |
| env: | |
| # https://github.com/actions/setup-go/issues/491 | |
| GOTOOLCHAIN: local | |
| jobs: | |
| release: | |
| name: Release | |
| strategy: | |
| matrix: | |
| os: | |
| - ubuntu-latest | |
| go: | |
| - '1.25' | |
| include: | |
| # Set the minimum Go patch version for the given Go minor | |
| # Usable via ${{ matrix.GO_SEMVER }} | |
| - go: '1.25' | |
| GO_SEMVER: '~1.25.0' | |
| runs-on: ${{ matrix.os }} | |
| # https://github.com/sigstore/cosign/issues/1258#issuecomment-1002251233 | |
| # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings | |
| permissions: | |
| id-token: write | |
| # https://docs.github.com/en/rest/overview/permissions-required-for-github-apps#permission-on-contents | |
| # "Releases" is part of `contents`, so it needs the `write` | |
| contents: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ matrix.GO_SEMVER }} | |
| check-latest: true | |
| # Force fetch upstream tags -- because 65 minutes | |
| # tl;dr: actions/checkout@v5 runs this line: | |
| # git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +ebc278ec98bb24f2852b61fde2a9bf2e3d83818b:refs/tags/ | |
| # which makes its own local lightweight tag, losing all the annotations in the process. Our earlier script ran: | |
| # git fetch --prune --unshallow | |
| # which doesn't overwrite that tag because that would be destructive. | |
| # Credit to @francislavoie for the investigation. | |
| # https://github.com/actions/checkout/issues/290#issuecomment-680260080 | |
| - name: Force fetch upstream tags | |
| run: git fetch --tags --force | |
| # https://github.community/t5/GitHub-Actions/How-to-get-just-the-tag-name/m-p/32167/highlight/true#M1027 | |
| - name: Print Go version and environment | |
| id: vars | |
| run: | | |
| printf "Using go at: $(which go)\n" | |
| printf "Go version: $(go version)\n" | |
| printf "\n\nGo environment:\n\n" | |
| go env | |
| printf "\n\nSystem environment:\n\n" | |
| env | |
| echo "version_tag=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT | |
| echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT | |
| # Add "pip install" CLI tools to PATH | |
| echo ~/.local/bin >> $GITHUB_PATH | |
| # Parse semver | |
| TAG=${GITHUB_REF/refs\/tags\//} | |
| SEMVER_RE='[^0-9]*\([0-9]*\)[.]\([0-9]*\)[.]\([0-9]*\)\([0-9A-Za-z\.-]*\)' | |
| TAG_MAJOR=`echo ${TAG#v} | sed -e "s#$SEMVER_RE#\1#"` | |
| TAG_MINOR=`echo ${TAG#v} | sed -e "s#$SEMVER_RE#\2#"` | |
| TAG_PATCH=`echo ${TAG#v} | sed -e "s#$SEMVER_RE#\3#"` | |
| TAG_SPECIAL=`echo ${TAG#v} | sed -e "s#$SEMVER_RE#\4#"` | |
| echo "tag_major=${TAG_MAJOR}" >> $GITHUB_OUTPUT | |
| echo "tag_minor=${TAG_MINOR}" >> $GITHUB_OUTPUT | |
| echo "tag_patch=${TAG_PATCH}" >> $GITHUB_OUTPUT | |
| echo "tag_special=${TAG_SPECIAL}" >> $GITHUB_OUTPUT | |
| - name: Validate commits and tag signatures | |
| run: | | |
| # Import Jed Liu's key | |
| curl 'https://github.com/liujed.gpg' | gpg --import | |
| echo "Verifying the tag: ${{ steps.vars.outputs.version_tag }}" | |
| # tags are only accepted if signed by Jed's key | |
| git verify-tag "${{ steps.vars.outputs.version_tag }}" || exit 1 | |
| # GoReleaser will take care of publishing those artifacts into the release | |
| - name: Run GoReleaser | |
| uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| version: latest | |
| args: release --clean --timeout 60m | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TAG: ${{ steps.vars.outputs.version_tag }} |