74f601a4eb- Emit sha256 checksums.txt so release downloads are independently verifiable. - Generate one CycloneDX JSON SBOM per archive via syft (syft installed in the release workflow before goreleaser runs). Foundations for the cosign signing step (which will sign the checksums file and thus transitively cover all archives + SBOMs). Refs forgejo-mcp-51l.
48 lines
1.1 KiB
YAML
48 lines
1.1 KiB
YAML
version: 2
|
|
builds:
|
|
- env:
|
|
- CGO_ENABLED=0
|
|
mod_timestamp: '{{ .CommitTimestamp }}'
|
|
flags:
|
|
- -trimpath
|
|
ldflags:
|
|
- '-s -w -X main.BuildTag={{.Version}} -X main.BuildCommit={{.Commit}} -X main.BuildDate={{.Date}}'
|
|
goos:
|
|
- linux
|
|
- darwin
|
|
goarch:
|
|
- amd64
|
|
- arm64
|
|
binary: '{{ .ProjectName }}'
|
|
archives:
|
|
- formats: ['tar.gz']
|
|
name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}'
|
|
wrap_in_directory: true
|
|
strip_binary_directory: true
|
|
format_overrides:
|
|
- goos: windows
|
|
formats: ['zip']
|
|
files:
|
|
- LICENSE
|
|
- README.md
|
|
checksum:
|
|
name_template: '{{ .ProjectName }}_{{ .Version }}_checksums.txt'
|
|
algorithm: sha256
|
|
|
|
# One CycloneDX SBOM per archive via syft. syft must be on PATH; the release
|
|
# workflow installs it before goreleaser runs.
|
|
sboms:
|
|
- id: archives
|
|
artifacts: archive
|
|
documents:
|
|
- '{{ .ArtifactName }}.sbom.cdx.json'
|
|
cmd: syft
|
|
args:
|
|
- scan
|
|
- '$artifact'
|
|
- --output
|
|
- 'cyclonedx-json=$document'
|
|
|
|
gitea_urls:
|
|
api: https://codeberg.org/api/v1
|
|
download: https://codeberg.org
|