mirror of
https://github.com/pgsty/silo.git
synced 2026-10-27 06:07:02 +00:00
Feng Ruohang
ee9252a608
Serialize release and finalize work by tag, replace only one unfinalized Draft, refuse published or finalized release state, and pin GoReleaser to the checked-out tag. Add fail-closed release-state fixtures to the release pipeline. Signed-off-by: Feng Ruohang <rh@vonng.com>
97 lines
2.3 KiB
YAML
97 lines
2.3 KiB
YAML
version: 2
|
|
|
|
env:
|
|
- CGO_ENABLED=0
|
|
|
|
builds:
|
|
- id: silo
|
|
main: .
|
|
binary: silo
|
|
goos:
|
|
- linux
|
|
- darwin
|
|
- windows
|
|
goarch:
|
|
- amd64
|
|
- arm64
|
|
goamd64:
|
|
- v1
|
|
flags:
|
|
- -tags=kqueue
|
|
- -trimpath
|
|
ldflags:
|
|
- "{{ .Env.LDFLAGS }}"
|
|
|
|
archives:
|
|
- id: silo
|
|
ids:
|
|
- silo
|
|
name_template: "silo_{{ .Env.PKG_VERSION }}_{{ .Os }}_{{ .Arch }}"
|
|
# Explicit so the license materials cannot silently drop out of the
|
|
# binary archives: GoReleaser's default file globs would miss NOTICE.
|
|
# CREDITS stays out deliberately -- at 1.8MB it would dominate the
|
|
# archive; it remains available in the repository and the OCI image.
|
|
files:
|
|
- README.md
|
|
- LICENSE
|
|
- NOTICE
|
|
|
|
checksum:
|
|
name_template: "silo_{{ .Env.PKG_VERSION }}_checksums.txt"
|
|
algorithm: sha256
|
|
|
|
# Generate one SPDX JSON document per platform archive. SBOMs are created
|
|
# before the checksum stage, so the signed checksum manifest covers both the
|
|
# archives and their corresponding software bills of materials.
|
|
sboms:
|
|
- id: silo-archives
|
|
artifacts: archive
|
|
# Avoid network-backed package enrichment: the release SBOM must be
|
|
# reproducible from the artifact alone and the PR gate must work offline.
|
|
args:
|
|
- "$artifact"
|
|
- "--output"
|
|
- "spdx-json=$document"
|
|
env:
|
|
- SYFT_FILE_METADATA_CATALOGER_ENABLED=true
|
|
- SYFT_CHECK_FOR_APP_UPDATE=false
|
|
|
|
# A keyless Sigstore bundle is the detached signature for the checksum
|
|
# manifest. Consumers can verify the whole archive/SBOM set without trusting a
|
|
# long-lived project key copied into the repository.
|
|
signs:
|
|
- id: silo-checksums
|
|
cmd: cosign
|
|
signature: "${artifact}.sigstore.json"
|
|
args:
|
|
- sign-blob
|
|
- "--bundle=${signature}"
|
|
- "${artifact}"
|
|
- --yes
|
|
artifacts: checksum
|
|
output: true
|
|
|
|
release:
|
|
github:
|
|
owner: pgsty
|
|
name: silo
|
|
draft: true
|
|
prerelease: false
|
|
replace_existing_draft: true
|
|
replace_existing_artifacts: false
|
|
mode: replace
|
|
# Draft replacement matches the release name; keep it identical to the tag.
|
|
name_template: "{{ .Tag }}"
|
|
|
|
changelog:
|
|
sort: asc
|
|
filters:
|
|
exclude:
|
|
- "^docs:"
|
|
- "^test:"
|
|
- "Merge pull request"
|
|
- "Merge branch"
|
|
|
|
announce:
|
|
skip: true
|