mirror of
https://github.com/pgsty/silo.git
synced 2026-10-26 13:50:26 +00:00
Feng Ruohang
969a6a42d3
Use ZIP for Windows amd64 and arm64. Validate the platform archive matrix, executable names, documentation, SBOMs and checksum coverage in the release pipeline. Validated with local GoReleaser snapshots, six SPDX SBOMs and packaging regression checks. Signed-off-by: Feng Ruohang <rh@vonng.com>
101 lines
2.4 KiB
YAML
101 lines
2.4 KiB
YAML
version: 2
|
|
|
|
env:
|
|
- CGO_ENABLED=0
|
|
|
|
builds:
|
|
- id: silo
|
|
main: .
|
|
binary: silo
|
|
goos:
|
|
- linux
|
|
- darwin
|
|
- windows
|
|
goarch:
|
|
- amd64
|
|
- arm64
|
|
goamd64:
|
|
- v1
|
|
flags:
|
|
- -tags=kqueue
|
|
- -trimpath
|
|
ldflags:
|
|
- "{{ .Env.LDFLAGS }}"
|
|
|
|
archives:
|
|
- id: silo
|
|
ids:
|
|
- silo
|
|
name_template: "silo_{{ .Env.PKG_VERSION }}_{{ .Os }}_{{ .Arch }}"
|
|
formats: ["tar.gz"]
|
|
format_overrides:
|
|
- goos: windows
|
|
formats: ["zip"]
|
|
# Explicit so the license materials cannot silently drop out of the
|
|
# binary archives: GoReleaser's default file globs would miss NOTICE.
|
|
# CREDITS stays out deliberately -- at 1.8MB it would dominate the
|
|
# archive; it remains available in the repository and the OCI image.
|
|
files:
|
|
- README.md
|
|
- LICENSE
|
|
- NOTICE
|
|
|
|
checksum:
|
|
name_template: "silo_{{ .Env.PKG_VERSION }}_checksums.txt"
|
|
algorithm: sha256
|
|
|
|
# Generate one SPDX JSON document per platform archive. SBOMs are created
|
|
# before the checksum stage, so the signed checksum manifest covers both the
|
|
# archives and their corresponding software bills of materials.
|
|
sboms:
|
|
- id: silo-archives
|
|
artifacts: archive
|
|
# Avoid network-backed package enrichment: the release SBOM must be
|
|
# reproducible from the artifact alone and the PR gate must work offline.
|
|
args:
|
|
- "$artifact"
|
|
- "--output"
|
|
- "spdx-json=$document"
|
|
env:
|
|
- SYFT_FILE_METADATA_CATALOGER_ENABLED=true
|
|
- SYFT_CHECK_FOR_APP_UPDATE=false
|
|
|
|
# A keyless Sigstore bundle is the detached signature for the checksum
|
|
# manifest. Consumers can verify the whole archive/SBOM set without trusting a
|
|
# long-lived project key copied into the repository.
|
|
signs:
|
|
- id: silo-checksums
|
|
cmd: cosign
|
|
signature: "${artifact}.sigstore.json"
|
|
args:
|
|
- sign-blob
|
|
- "--bundle=${signature}"
|
|
- "${artifact}"
|
|
- --yes
|
|
artifacts: checksum
|
|
output: true
|
|
|
|
release:
|
|
github:
|
|
owner: pgsty
|
|
name: silo
|
|
draft: true
|
|
prerelease: false
|
|
replace_existing_draft: true
|
|
replace_existing_artifacts: false
|
|
mode: replace
|
|
# Draft replacement matches the release name; keep it identical to the tag.
|
|
name_template: "{{ .Tag }}"
|
|
|
|
changelog:
|
|
sort: asc
|
|
filters:
|
|
exclude:
|
|
- "^docs:"
|
|
- "^test:"
|
|
- "Merge pull request"
|
|
- "Merge branch"
|
|
|
|
announce:
|
|
skip: true
|