release.yml

name: Release

on:
  push:
    tags:
    - "v*"

jobs:
  dist:
    runs-on: ubuntu-latest
    permissions:
      contents: write # Required to publish a release
      packages: write # Required to push the docker images
      id-token: write # Required for Cosign Keyless OIDC flow

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      with:
        fetch-depth: 0

    - name: Determine Go version from go.mod
      run: echo "GO_VERSION=$(go mod edit -json | jq -r .Go)" >> $GITHUB_ENV

    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
      with:
        go-version: ${{ env.GO_VERSION }}

    - name: Install Cosign
      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

    - name: Check Cosign installation
      run: cosign version

    - name: Set up QEMU
      uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4


    - name: Login to quay.io
      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
      with:
        registry: quay.io
        username: ${{ secrets.QUAY_IO_USERNAME }}
        password: ${{ secrets.QUAY_IO_PASSWORD }}

    - name: Login to GHCR
      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Build changelog from PRs with labels
      id: build_changelog
      uses: mikepenz/release-changelog-builder-action@aa013739bbc8e7067dbbecd4525ff11aeb51a84b # v6
      with:
        configuration: ".github/changelog-configuration.json"
        # PreReleases still get a changelog, but the next full release gets a diff since the last full release,
        # combining possible changelogs of all previous PreReleases in between. PreReleases show a partial changelog
        # since last PreRelease.
        ignorePreReleases: "${{ !contains(github.ref, '-rc') }}"
        outputFile: .github/release-notes.md
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Publish releases
      uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7
      with:
        args: release --release-notes .github/release-notes.md
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Verify ghcr.io image signature
      run: |
        cosign verify ghcr.io/${{ github.repository }}:${{ github.ref_name }} \
          --certificate-identity "https://github.com/${{ github.workflow_ref }}" \
          --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

    - name: Verify quay.io image signature
      run: |
        cosign verify quay.io/${{ github.repository }}:${{ github.ref_name }} \
          --certificate-identity "https://github.com/${{ github.workflow_ref }}" \
          --certificate-oidc-issuer "https://token.actions.githubusercontent.com"