.goreleaser.yaml

# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
# vim: set ts=2 sw=2 tw=0 fo=cnqoj
#
# GoReleaser v2 configuration for opnDossier
# Updated for Cosign v3, keyless signing, and current best practices
#
# See also: .github/workflows/release.yml
# Reference: https://github.com/goreleaser/example-supply-chain

version: 2

project_name: opnDossier

before:
  hooks:
    - go mod tidy
    - go generate ./...
    - git-cliff --output CHANGELOG.md
    - just notices
    # Build binary first for generating documentation
    - go build -o ./opndossier-temp ./main.go
    # Generate shell completions
    - mkdir -p ./packaging/completions
    - bash -c './opndossier-temp completion bash > ./packaging/completions/opndossier.bash'
    - bash -c './opndossier-temp completion zsh > ./packaging/completions/opndossier.zsh'
    - bash -c './opndossier-temp completion fish > ./packaging/completions/opndossier.fish'
    - bash -c './opndossier-temp completion powershell > ./packaging/completions/opndossier.ps1'
    # Generate man pages
    - ./opndossier-temp man ./packaging/
    # Clean up temporary binary
    - rm ./opndossier-temp

# Build configuration
# https://goreleaser.com/customization/builds/go/
builds:
  - id: opndossier
    binary: opndossier
    main: ./main.go
    env:
      - CGO_ENABLED=0
    goos:
      - freebsd
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
    ignore:
      - goos: freebsd
        goarch: arm64
    flags:
      - -trimpath
    ldflags:
      # Use CommitDate for reproducible builds
      - >-
        -s -w
        -X main.version={{.Version}}
        -X github.com/EvilBit-Labs/opnDossier/cmd.buildDate={{ .CommitDate }}
        -X github.com/EvilBit-Labs/opnDossier/cmd.gitCommit={{.Commit}}
    # Ensures mod timestamp matches commit for reproducibility
    mod_timestamp: "{{ .CommitTimestamp }}"
    # NOTE: macOS code signing moved to universal_binaries.hooks.post so it runs
    # on the combined universal binary, not the individual arch binaries that
    # get replaced by universal_binaries with replace: true.

# Archive configuration
# https://goreleaser.com/customization/archive/
archives:
  - id: default
    formats: [tar.gz]
    name_template: >-
      {{ .ProjectName }}_
      {{- title .Os }}_
      {{- if eq .Arch "amd64" }}x86_64
      {{- else if eq .Arch "386" }}i386
      {{- else }}{{ .Arch }}{{ end }}
      {{- if .Arm }}v{{ .Arm }}{{ end }}
    format_overrides:
      - goos: windows
        formats: [zip]
    files:
      - LICENSE
      - README.md
      - CHANGELOG.md
      - THIRD_PARTY_NOTICES
      - src: ./packaging/completions/*
        dst: completions
      - src: ./packaging/opndossier.1
        dst: man/opndossier.1
    # Preserve commit timestamp for reproducibility
    builds_info:
      mtime: "{{ .CommitTimestamp }}"

# Checksum configuration
# https://goreleaser.com/customization/checksum/
checksum:
  name_template: "{{ .ProjectName }}_checksums.txt"

# Changelog: git-cliff generates CHANGELOG.md in before hooks
# GoReleaser uses its default git provider for the GitHub Release body
changelog:
  use: git

# Release configuration
# https://goreleaser.com/customization/release/
release:
  github:
    owner: "EvilBit-Labs"
    name: "opnDossier"
  prerelease: auto
  include_meta: true
  header: |
    ## Release {{.Tag}}

    This release includes the following changes:
  footer: |
    **Full Changelog**: https://github.com/EvilBit-Labs/opnDossier/compare/{{.PreviousTag}}...{{.Tag}}

    ## Security Information

    This release includes:
    - SBOM (Software Bill of Materials) generated with CycloneDX-gomod
    - SLSA Level 3 provenance attestation
    - Cosign keyless signatures (Sigstore)

    ### Verify Signatures

    ```bash
    # Download the checksum file and its signature
    wget https://github.com/EvilBit-Labs/opnDossier/releases/download/{{.Tag}}/opnDossier_checksums.txt
    wget https://github.com/EvilBit-Labs/opnDossier/releases/download/{{.Tag}}/opnDossier_checksums.txt.sigstore.json

    # Verify with cosign v3
    cosign verify-blob \
      --certificate-identity "https://github.com/EvilBit-Labs/opnDossier/.github/workflows/release.yml@refs/tags/{{.Tag}}" \
      --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
      --bundle opnDossier_checksums.txt.sigstore.json \
      opnDossier_checksums.txt
    ```

    ## Installation

    ### Package Managers

    **Debian/Ubuntu (.deb)**:
    ```bash
    wget https://github.com/EvilBit-Labs/opnDossier/releases/download/{{.Tag}}/opndossier_{{.Version}}_amd64.deb
    sudo dpkg -i opndossier_{{.Version}}_amd64.deb
    ```

    **Red Hat/CentOS/Fedora (.rpm)**:
    ```bash
    wget https://github.com/EvilBit-Labs/opnDossier/releases/download/{{.Tag}}/opndossier-{{.Version}}-1.x86_64.rpm
    sudo rpm -i opndossier-{{.Version}}-1.x86_64.rpm
    ```

    **Alpine (.apk)**:
    ```bash
    wget https://github.com/EvilBit-Labs/opnDossier/releases/download/{{.Tag}}/opndossier_{{.Version}}_x86_64.apk
    sudo apk add --allow-untrusted opndossier_{{.Version}}_x86_64.apk
    ```

    **Arch Linux**:
    ```bash
    wget https://github.com/EvilBit-Labs/opnDossier/releases/download/{{.Tag}}/opndossier-{{.Version}}-1-x86_64.pkg.tar.zst
    sudo pacman -U opndossier-{{.Version}}-1-x86_64.pkg.tar.zst
    ```

    > **Note:** For pre-release versions (e.g., `1.4.0-rc.1`), package filenames
    > use format-specific version transforms (`~` for deb/rpm, `_` for apk,
    > concatenated for archlinux). Check the release assets list for exact filenames.

    ### Download Binary
    Download the appropriate binary for your platform from the assets below.

    ### Verify Checksums
    ```bash
    sha256sum -c opnDossier_checksums.txt
    ```

# Source tarball (disabled - use git clone instead)
source:
  enabled: false

# Universal binaries for macOS (combines amd64 and arm64)
# With replace: true, the individual darwin/amd64 and darwin/arm64 binaries are
# removed from artifacts and replaced by a single darwin/all universal binary.
# The archive name_template produces "Darwin_all" for the Arch variable.
universal_binaries:
  - id: opndossier-universal
    ids:
      - opndossier
    replace: true
    hooks:
      post:
        # macOS code signing with quill (optional, requires Apple credentials)
        # Set QUILL_SIGN_P12, QUILL_SIGN_PASSWORD, QUILL_NOTARY_KEY, QUILL_NOTARY_KEY_ID, QUILL_NOTARY_ISSUER
        # For snapshots: ad-hoc signing only (no notarization)
        # For releases: full signing and notarization
        # Runs on the universal binary (not individual arch binaries) so the
        # signed artifact is what ships in the release tarball.
        - cmd: >-
            {{ if isEnvSet "QUILL_SIGN_P12" }}
            quill sign-and-notarize "{{ .Path }}" --dry-run={{ .IsSnapshot }} --ad-hoc={{ .IsSnapshot }} -vv
            {{ end }}
          env:
            - QUILL_LOG_FILE=/tmp/quill-universal.log
          output: true

# Milestone auto-close
milestones:
  - repo:
      owner: "EvilBit-Labs"
      name: opnDossier
    close: true
    fail_on_error: false

# Homebrew cask
# https://goreleaser.com/customization/homebrew_casks/
homebrew_casks:
  - name: opndossier
    repository:
      owner: EvilBit-Labs
      name: homebrew-tap
      token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
    directory: Casks
    homepage: https://github.com/EvilBit-Labs/opnDossier
    description: "OPNsense configuration documentation and compliance auditing tool"
    binaries:
      - opndossier
    manpages:
      - man/opndossier.1
    completions:
      bash: completions/opndossier.bash
      zsh: completions/opndossier.zsh
      fish: completions/opndossier.fish
    commit_author:
      name: goreleaserbot
      email: bot@goreleaser.com
    commit_msg_template: "Cask update for {{ .ProjectName }} version {{ .Tag }}"

# Linux packages (deb, rpm, apk, archlinux)
# https://goreleaser.com/customization/nfpm/
nfpms:
  - id: packages
    package_name: opndossier
    file_name_template: "{{ .ConventionalFileName }}"
    vendor: EvilBit Labs
    homepage: https://github.com/EvilBit-Labs/opnDossier
    maintainer: EvilBit Labs <support@evilbitlabs.io>
    description: |
      opnDossier is a command-line interface (CLI) tool designed to process OPNsense firewall configuration files (config.xml) and convert them into human-readable formats, primarily Markdown. This tool assists network administrators and security professionals in documenting, auditing, and understanding their OPNsense configurations more effectively.
    license: Apache-2.0
    section: utils
    priority: optional
    formats:
      - deb
      - rpm
      - apk
      - archlinux
    dependencies:
      - ca-certificates
    recommends:
      - git
      - curl
    suggests:
      - bash-completion
    bindir: /usr/bin
    contents:
      # Documentation
      - src: ./LICENSE
        dst: /usr/share/doc/opndossier/LICENSE
        file_info:
          mode: 0644
      - src: ./README.md
        dst: /usr/share/doc/opndossier/README.md
        file_info:
          mode: 0644
      - src: ./CHANGELOG.md
        dst: /usr/share/doc/opndossier/CHANGELOG.md
        file_info:
          mode: 0644
      - src: ./THIRD_PARTY_NOTICES
        dst: /usr/share/doc/opndossier/THIRD_PARTY_NOTICES
        file_info:
          mode: 0644
      # Man page
      - src: ./packaging/opndossier.1
        dst: /usr/share/man/man1/opndossier.1
        file_info:
          mode: 0644
      # Shell completions
      - src: ./packaging/completions/opndossier.bash
        dst: /usr/share/bash-completion/completions/opndossier
        file_info:
          mode: 0644
      - src: ./packaging/completions/opndossier.zsh
        dst: /usr/share/zsh/site-functions/_opndossier
        file_info:
          mode: 0644
      - src: ./packaging/completions/opndossier.fish
        dst: /usr/share/fish/vendor_completions.d/opndossier.fish
        file_info:
          mode: 0644
    rpm:
      group: Applications/System
      compression: lzma
      signature:
        key_file: '{{ if index .Env "RPM_SIGNING_KEY_FILE" }}{{ .Env.RPM_SIGNING_KEY_FILE }}{{ end }}'
    deb:
      compression: xz
      signature:
        key_file: '{{ if index .Env "DEB_SIGNING_KEY_FILE" }}{{ .Env.DEB_SIGNING_KEY_FILE }}{{ end }}'
    apk:
      signature:
        key_file: '{{ if index .Env "APK_SIGNING_KEY_FILE" }}{{ .Env.APK_SIGNING_KEY_FILE }}{{ end }}'
    archlinux:
      pkgbase: opndossier
      packager: EvilBit Labs <support@evilbitlabs.io>

winget:
  - name: opndossier
    publisher: EvilBit Labs
    short_description: OPNsense configuration documentation and compliance auditing tool
    description: |
      opnDossier is a command-line interface (CLI) tool designed to process OPNsense firewall configuration files (config.xml) and convert them into human-readable formats, primarily Markdown. This tool assists network administrators and security professionals in documenting, auditing, and understanding their OPNsense configurations more effectively.
    license: Apache-2.0
    homepage: https://github.com/EvilBit-Labs/opnDossier
    publisher_url: "https://evilbitlabs.io/opnDossier"
    publisher_support_url: "https://github.com/EvilBit-Labs/opnDossier/issues/new"
    privacy_url: "https://evilbitlabs.io/privacy"
    tags:
      - opnsense
      - firewall
      - audit
      - compliance
      - cli
      - security
    # Manifests are generated but not pushed until the fork exists.
    # To enable: fork microsoft/winget-pkgs to EvilBit-Labs/winget-pkgs,
    # then change skip_upload to 'auto' (skips prereleases only).
    skip_upload: true
    repository:
      owner: EvilBit-Labs
      name: winget-pkgs
      branch: "{{.ProjectName}}-{{.Version}}"
      pull_request:
        enabled: true
        base:
          owner: microsoft
          name: winget-pkgs
          branch: master

# Docker image configuration (v2 - native multi-platform)
# https://goreleaser.com/customization/package/dockers_v2
dockers_v2:
  # Versioned tag — always pushed, including pre-releases
  - id: ghcr-versioned
    images:
      - "ghcr.io/evilbit-labs/opndossier"
    tags:
      - "{{ .Tag }}"
    dockerfile: Dockerfile
    platforms:
      - linux/amd64
      - linux/arm64
    labels:
      org.opencontainers.image.created: "{{.Date}}"
      org.opencontainers.image.title: "{{.ProjectName}}"
      org.opencontainers.image.revision: "{{.FullCommit}}"
      org.opencontainers.image.version: "{{.Version}}"
      org.opencontainers.image.source: "https://github.com/EvilBit-Labs/opnDossier"
      org.opencontainers.image.licenses: "Apache-2.0"
    annotations:
      org.opencontainers.image.source: "https://github.com/EvilBit-Labs/opnDossier"

  # Floating tags (latest, major) — stable releases only.
  # Disabled entirely for prerelease builds to avoid pushing empty tags.
  - id: ghcr-stable
    disable: "{{ if .Prerelease }}true{{ else }}false{{ end }}"
    images:
      - "ghcr.io/evilbit-labs/opndossier"
    tags:
      - "v{{ .Major }}"
      - "latest"
    dockerfile: Dockerfile
    platforms:
      - linux/amd64
      - linux/arm64
    labels:
      org.opencontainers.image.created: "{{.Date}}"
      org.opencontainers.image.title: "{{.ProjectName}}"
      org.opencontainers.image.revision: "{{.FullCommit}}"
      org.opencontainers.image.version: "{{.Version}}"
      org.opencontainers.image.source: "https://github.com/EvilBit-Labs/opnDossier"
      org.opencontainers.image.licenses: "Apache-2.0"
    annotations:
      org.opencontainers.image.source: "https://github.com/EvilBit-Labs/opnDossier"

# Docker image signing with Cosign (keyless)
# https://goreleaser.com/customization/docker_sign/
docker_signs:
  - cmd: cosign
    args:
      - "sign"
      - "--yes"
      - "${artifact}"
    artifacts: manifests
    output: true

# SBOM generation with CycloneDX-gomod
# https://goreleaser.com/customization/sbom/
# https://github.com/CycloneDX/cyclonedx-gomod
sboms:
  - id: binary-sbom
    documents:
      - "{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.bom.json"
    artifacts: binary
    cmd: cyclonedx-gomod
    args: ["bin", "-json", "-output", "$document", "$artifact"]
  - id: module-sbom
    documents:
      - "{{ .ProjectName }}_{{ .Version }}_module.bom.json"
    artifacts: any
    cmd: cyclonedx-gomod
    args: ["mod", "-licenses", "-std", "-json", "-output", "$document", "../"]

# Artifact signing configuration
# https://goreleaser.com/customization/sign/
signs:
  # Cosign v3 keyless signing for checksums (Sigstore transparency log)
  # https://goreleaser.com/blog/cosign-v3/
  - id: checksum-cosign
    cmd: cosign
    signature: "${artifact}.sigstore.json"
    args:
      - "sign-blob"
      - "--bundle=${signature}"
      - "${artifact}"
      - "--yes"
    artifacts: checksum
    output: true

  # GPG signing disabled for now - re-enable when secrets are properly configured
  # See RELEASING.md for GPG setup instructions