release.yml

name: goreleaser

on:
  push:
    tags:
      - "*"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  goreleaser:
    name: build and push
    runs-on: ubuntu-latest
    permissions:
      contents: write # Needed to create releases and update files
      id-token: write # Needed for cosign
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0
          persist-credentials: false
      - run: git fetch --force --tags
      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
        with:
          go-version: ">=1.26.0"
          cache: false
      - name: Install cosign
        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5
      - uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29
        with:
          distribution: goreleaser
          version: "v2.14.1"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}