.goreleaser.yml

# GoReleaser configuration for Symaira Vault
# Documentation: https://goreleaser.com

version: 2

before:
  hooks:
    - env GOWORK=off go mod tidy
    - env GOWORK=off go mod download
    - env GOWORK=off make completions
    - env GOWORK=off make manpages
    - >-
      sh -c 'SENSITIVE_FILES="identity.age mcp-token .env coverage coverage.out *.test cmd.test mcp.test vault.test";
      for f in $SENSITIVE_FILES; do
      if [ -e "$f" ]; then
      echo "ERROR: Sensitive file found in project root: $f";
      exit 1;
      fi;
      done;
      if find . -name ".env" -not -path "./.git/*" 2>/dev/null | grep -q .; then
      echo "ERROR: .env file found outside .git - remove before release";
      exit 1;
      fi;
      echo "Secret/artifact gate passed"'

builds:
  - id: symvault-static
    main: .
    binary: symvault
    hooks:
      post:
        - 'scripts/build-mcpb.sh --version "{{ .Version }}" --os "{{ .Os }}" --arch "{{ .Arch }}" --binary "{{ .Path }}"'
    env:
      - CGO_ENABLED=0
      - GOWORK=off
    goos:
      - linux
      - windows
      - freebsd
    goarch:
      - amd64
      - arm64
    goamd64:
      - v1
    goarm:
      - "7"
    ldflags:
      - -s -w
      - -X main.version={{.Version}}
      - -X main.commit={{.Commit}}
      - -X main.date={{.Date}}
      - -X main.builtBy=goreleaser
    mod_timestamp: "{{ .CommitTimestamp }}"
  - id: symvault-darwin
    main: .
    binary: symvault
    hooks:
      post:
        - 'scripts/build-mcpb.sh --version "{{ .Version }}" --os "{{ .Os }}" --arch "{{ .Arch }}" --binary "{{ .Path }}"'
        - cmd: sh -c 'if [ -n "${CODESIGN_IDENTITY:-}" ]; then codesign -s "$CODESIGN_IDENTITY" --timestamp --options runtime "{{ .Path }}"; echo "Signed {{ .Path }}"; fi'
    env:
      - CGO_ENABLED=1
      - GOWORK=off
    goos:
      - darwin
    goarch:
      - amd64
      - arm64
    goamd64:
      - v1
    ldflags:
      - -s -w
      - -X main.version={{.Version}}
      - -X main.commit={{.Commit}}
      - -X main.date={{.Date}}
      - -X main.builtBy=goreleaser
    mod_timestamp: "{{ .CommitTimestamp }}"

# macOS code signing and notarization
# Requires Apple Developer ID (Team ID: M4744F3TAA) and App Store Connect API keys.
# Kept commented out until repository secrets are configured in GitHub Actions:
# - APPLE_DEVELOPER_ID_CERTIFICATE
# - APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD
# - APPLE_API_KEY_ID
# - APPLE_API_ISSUER_ID
# - APPLE_API_KEY_BASE64
# (See docs/macos-notarization.md)
#
# notarize:
#   macos:
#     - enabled: true
#       sign:
#         certificate: "{{ .Env.APPLE_DEVELOPER_ID_CERTIFICATE }}"
#         password: "{{ .Env.APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD }}"
#       issuer_id: "{{ .Env.APPLE_API_ISSUER_ID }}"
#       key_id: "{{ .Env.APPLE_API_KEY_ID }}"
#       key: "{{ .Env.APPLE_API_KEY_BASE64 }}"
#       wait: true
#       timeout: 20m

archives:
  - id: symvault
    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
    formats: [tar.gz]
    format_overrides:
      - goos: windows
        formats: [zip]
    files:
      - LICENSE
      - README.md
      - completions/*
      - docs/man/*.1
    wrap_in_directory: true

checksum:
  name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt"
  algorithm: sha256

changelog:
  sort: asc
  use: github
  filters:
    exclude:
      - "^docs:"
      - "^test:"
      - "^chore:"
      - "^ci:"
      - Merge pull request
      - Merge branch
  groups:
    - title: Features
      regexp: "^feat[:\\(]"
      order: 0
    - title: Bug Fixes
      regexp: "^fix[:\\(]"
      order: 1
    - title: Performance Improvements
      regexp: "^perf[:\\(]"
      order: 2
    - title: Others
      order: 999

release:
  github:
    owner: "danieljustus"
    name: "symaira-vault"
  draft: false
  prerelease: auto
  name_template: "{{ .Tag }}"
  header: |
    ## Symaira Vault {{ .Version }}
    
    Symaira Vault is a secure password management CLI tool.
  footer: |
    ## Installation

    ### Quick install (recommended)

    **macOS / Linux:**
    ```bash
    curl -sSfL https://raw.githubusercontent.com/danieljustus/symaira-vault/main/scripts/install.sh | sh
    ```

    **Windows (PowerShell):**
    ```powershell
    irm https://raw.githubusercontent.com/danieljustus/symaira-vault/main/scripts/install.ps1 | iex
    ```

    ### Download
    Download the appropriate binary for your platform from the assets below.

    ### Build from source
    ```bash
    go install github.com/danieljustus/symaira-vault@{{ .Tag }}
    ```

brews:
  - name: symvault
    repository:
      owner: danieljustus
      name: homebrew-tap
      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
    directory: Formula
    homepage: "https://github.com/danieljustus/symaira-vault"
    description: "Modern CLI password manager with age encryption"
    license: "Apache-2.0"
    custom_block: |
      version_scheme 1
    install: |
      bin.install "symvault"
      generate_completions_from_executable(bin/"symvault", "completion")
      man1.install Dir["docs/man/*.1"]
    caveats: |
      Symaira Vault has been installed!

      To get started:
        symvault init                    # Initialize a new vault
        symvault set github.com/username # Add your first entry
        symvault get github.com/username # Retrieve it

      For MCP server setup:
        symvault mcp-config <name>

      Documentation: https://github.com/danieljustus/symaira-vault#readme
    test: |
      system "#{bin}/symvault", "version"

scoops:
  - name: symvault
    repository:
      owner: danieljustus
      name: scoop-bucket
      token: "{{ .Env.SCOOP_BUCKET_GITHUB_TOKEN }}"
    homepage: "https://github.com/danieljustus/symaira-vault"
    description: "Modern CLI password manager with age encryption"
    license: Apache-2.0
    persist:
      - config.yaml

nfpms:
  - id: symvault
    package_name: symvault
    file_name_template: "{{ .PackageName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
    vendor: danieljustus
    homepage: "https://github.com/danieljustus/symaira-vault"
    maintainer: "danieljustus <88160656+danieljustus@users.noreply.github.com>"
    description: "Secure password management CLI tool"
    license: "Apache-2.0"
    formats:
      - deb
      - rpm
      - apk
    recommends:
      - git
    bindir: /usr/bin
    section: utils
    priority: optional


sboms:
  - artifacts: archive
    documents:
      - "${artifact}.sbom.json"
    cmd: syft
    args: ["$artifact", "--output", "cyclonedx-json=$document"]

signs:
  - cmd: cosign
    certificate: "${artifact}.pem"
    args: ["sign-blob", "--yes", "--output-certificate=${certificate}", "--output-signature=${signature}", "${artifact}"]
    artifacts: all

snapshot:
  version_template: "{{ incpatch .Version }}-next"

dist: dist