release.yml

name: Release

on:
  push:
    tags:
      - "v*"

# Default-deny at the workflow level. Each job opts into the
# narrowest scopes it actually needs.
permissions: {}

jobs:
  goreleaser:
    name: GoReleaser
    runs-on: ubuntu-latest
    permissions:
      # goreleaser needs to push the GitHub Release + upload assets.
      contents: write
      # id-token grants Sigstore / cosign keyless OIDC signing
      # (see the `signs:` block in .goreleaser.yaml).
      id-token: write
    outputs:
      # Base64-encoded `<sha256>  <filename>` lines from
      # dist/checksums.txt, consumed by the downstream provenance
      # job as the SLSA `base64-subjects` input.
      hashes: ${{ steps.checksum-hashes.outputs.hashes }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: true
      # Put syft on PATH so goreleaser's `sboms:` block can shell
      # out to it without an inline download step.
      - name: Install syft
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0
      # Put cosign on PATH so goreleaser's `signs:` block can shell
      # out to it. Keyless OIDC signing uses the workflow's id-token
      # (the workflow-level `permissions:` already grants id-token:write).
      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - name: GoReleaser
        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Fine-grained PAT with `contents: write` on amiwrpremium/homebrew-tap.
          # Create it in settings and store as the HOMEBREW_TAP_TOKEN secret.
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}

      # Emit base64-encoded `<sha256>  <filename>` lines from
      # dist/checksums.txt so the downstream SLSA generator job
      # can attest over the full release artefact set in one
      # provenance bundle.
      - name: Compute SLSA subjects from checksums.txt
        id: checksum-hashes
        run: |
          set -euo pipefail
          if [ ! -f dist/checksums.txt ]; then
            echo "::error::dist/checksums.txt missing after goreleaser run"
            exit 1
          fi
          HASHES=$(base64 -w0 < dist/checksums.txt)
          echo "hashes=$HASHES" >> "$GITHUB_OUTPUT"

  # SLSA Level 3 generic generator. Pinned by tag, not SHA: the
  # generator's builder-fetch step rejects SHA refs and requires
  # `@vX.Y.Z` form, relying on TUF + sigstore signature
  # verification of the builder binary instead. pin-check.yml's
  # allow-list documents and permits this single carve-out.
  provenance:
    name: SLSA provenance
    needs: goreleaser
    if: ${{ always() && needs.goreleaser.result == 'success' }}
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: ${{ needs.goreleaser.outputs.hashes }}
      provenance-name: macontrol.intoto.jsonl
      upload-assets: true
      upload-tag-name: ${{ github.ref_name }}