Skip to content

Release

Release #1

Workflow file for this run

on:
push:
tags: ['v*.*.*']
permissions:
contents: write
id-token: write
attestations: write
packages: write
name: Release
jobs:
release:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
- uses: DeterminateSystems/nix-installer-action@21a544727d0c62386e78b4befe52d19ad12692e3 # v17
- uses: DeterminateSystems/magic-nix-cache-action@def9f5a5c6a6b8751c0534e8813a5d0ad2635660 # v11
# Download all modules, and taints the source if there's a mismatch, which goreleaser will conveniently refuse to release.
- name: Download modules
run: nix develop --command tidy
# TODO: Unclear if GPG signing with goreleaser in Nix, disable.
- name: goreleaser
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
nix develop --command goreleaser release --clean --fail-fast --skip=sign
- uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
with:
subject-checksums: dist/SHA256SUMS