gittuf/.github/workflows/release.yml

name: release
on:
  push:
    tags:
      - 'v*'
permissions: read-all
jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      attestations: write
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0 # fetch full history for previous tag information
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
        with:
          go-version: '1.26'
          cache: true
      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6
      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610
      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94
        with:
          distribution: goreleaser-pro
          version: latest
          args: release --clean --skip=winget
        env:
          WINGET_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
      # Attest the output SBOM
      - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/git**/**
          sbom-path: dist/gittuf.src.tar.gz.sbom.json
      # Generate SLSA build provenance attestations
      - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/git**/**