Skip to content

Commit 8c37858

Browse files
JAORMXJAORMX
authored
Merge pull request #7 from stacklok/goreleaser
Add goreleaser configuration and release workflow
2 parents 11e2ae1 + a458541 commit 8c37858

File tree

2 files changed

+239
-0
lines changed

2 files changed

+239
-0
lines changed

‎.github/workflows/releaser.yml

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
#
2+
# Copyright 2023 Stacklok, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
# This workflow compiles frizbee using a SLSA3 compliant
17+
# build and then verifies the provenance of the built artifacts.
18+
# It releases the following architectures: amd64, arm64, and armv7 on Linux,
19+
# Windows, and macOS.
20+
# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
21+
# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.
22+
23+
name: Release
24+
on:
25+
push:
26+
tags:
27+
- '*'
28+
29+
permissions:
30+
contents: write
31+
32+
jobs:
33+
release:
34+
name: Build and release
35+
outputs:
36+
hashes: ${{ steps.hash.outputs.hashes }}
37+
permissions:
38+
contents: write # To add assets to a release.
39+
id-token: write # To do keyless signing with cosign
40+
runs-on: ubuntu-latest
41+
steps:
42+
- name: Checkout
43+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
44+
with:
45+
fetch-depth: 0
46+
47+
- name: Setup Go
48+
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4
49+
with:
50+
go-version-file: 'go.mod'
51+
cache: true
52+
53+
- name: Install Syft
54+
uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 # v0.14.3
55+
56+
- name: Install Cosign
57+
uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
58+
59+
- name: Run GoReleaser
60+
id: run-goreleaser
61+
uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5
62+
with:
63+
distribution: goreleaser
64+
version: latest
65+
args: release --clean
66+
env:
67+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
68+
HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
69+
WINGET_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
70+
71+
- name: Generate subject
72+
id: hash
73+
env:
74+
ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
75+
run: |
76+
set -euo pipefail
77+
hashes=$(echo $ARTIFACTS | jq --raw-output '.[] | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {digest} + {name} | join(" ") | sub("^sha256:";"")' | base64 -w0)
78+
if test "$hashes" = ""; then # goreleaser < v1.13.0
79+
checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
80+
hashes=$(cat $checksum_file | base64 -w0)
81+
fi
82+
echo "hashes=$hashes" >> $GITHUB_OUTPUT
83+
84+
provenance:
85+
name: Generate provenance (SLSA3)
86+
needs:
87+
- release
88+
permissions:
89+
actions: read # To read the workflow path.
90+
id-token: write # To sign the provenance.
91+
contents: write # To add assets to a release.
92+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@07e64b653f10a80b6510f4568f685f8b7b9ea830 # v1.9.0
93+
with:
94+
base64-subjects: "${{ needs.release.outputs.hashes }}"
95+
upload-assets: true # upload to a new release
96+
97+
verification:
98+
name: Verify provenance of assets (SLSA3)
99+
needs:
100+
- release
101+
- provenance
102+
runs-on: ubuntu-latest
103+
permissions: read-all
104+
steps:
105+
- name: Install the SLSA verifier
106+
uses: slsa-framework/slsa-verifier/actions/installer@7e1e47d7d793930ab0082c15c2b971fdb53a3c95 # v2.4.1
107+
- name: Download assets
108+
env:
109+
GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
110+
CHECKSUMS: "${{ needs.release.outputs.hashes }}"
111+
ATT_FILE_NAME: "${{ needs.provenance.outputs.provenance-name }}"
112+
run: |
113+
set -euo pipefail
114+
checksums=$(echo "$CHECKSUMS" | base64 -d)
115+
while read -r line; do
116+
fn=$(echo $line | cut -d ' ' -f2)
117+
echo "Downloading $fn"
118+
gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "$fn"
119+
done <<<"$checksums"
120+
gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "$ATT_FILE_NAME"
121+
- name: Verify assets
122+
env:
123+
CHECKSUMS: "${{ needs.release.outputs.hashes }}"
124+
PROVENANCE: "${{ needs.provenance.outputs.provenance-name }}"
125+
run: |
126+
set -euo pipefail
127+
checksums=$(echo "$CHECKSUMS" | base64 -d)
128+
while read -r line; do
129+
fn=$(echo $line | cut -d ' ' -f2)
130+
echo "Verifying SLSA provenance for $fn"
131+
slsa-verifier verify-artifact --provenance-path "$PROVENANCE" \
132+
--source-uri "github.com/$GITHUB_REPOSITORY" \
133+
--source-tag "$GITHUB_REF_NAME" \
134+
"$fn"
135+
done <<<"$checksums"

‎.goreleaser.yaml

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
2+
# vim: set ts=2 sw=2 tw=0 fo=cnqoj
3+
project_name: frizbee
4+
# This section defines the build matrix.
5+
builds:
6+
- env:
7+
- GO111MODULE=on
8+
- CGO_ENABLED=0
9+
flags:
10+
- -trimpath
11+
- -tags=netgo
12+
# TODO: Add ldflags
13+
# ldflags:
14+
# - "-X main.Version={{ .Env.VERSION }}"
15+
# - "-X main.Commit={{ .Env.COMMIT }}"
16+
# - "-X main.CommitDate={{ .Env.COMMIT_DATE }}"
17+
# - "-X main.TreeState={{ .Env.TREE_STATE }}"
18+
goos:
19+
- linux
20+
- windows
21+
- darwin
22+
goarch:
23+
- amd64
24+
- arm64
25+
main: ./main.go
26+
# This section defines the release format.
27+
archives:
28+
- format: tar.gz # we can use binary, but it seems there's an issue where goreleaser skips the sboms
29+
name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
30+
format_overrides:
31+
- goos: windows
32+
format: zip
33+
# This section defines how to release to homebrew.
34+
brews:
35+
- homepage: 'https://github.com/stacklok/frizbee'
36+
description: 'frizbee is a tool you may throw a tag at and it comes back with a checksum.'
37+
folder: Formula
38+
commit_author:
39+
name: stacklokbot
40+
email: [email protected]
41+
repository:
42+
owner: stacklok
43+
name: homebrew-tap
44+
token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
45+
test: |
46+
system "#{bin}/frizbee --help"
47+
# This section defines how to release to winget.
48+
winget:
49+
- name: frizbee
50+
publisher: stacklok
51+
license: Apache-2.0
52+
license_url: "https://github.com/stacklok/frizbee/blob/main/LICENSE"
53+
copyright: Stacklok, Inc.
54+
homepage: https://stacklok.com
55+
short_description: 'frizbee is a tool you may throw a tag at and it comes back with a checksum.'
56+
publisher_support_url: "https://github.com/stacklok/frizbee/issues/new/choose"
57+
package_identifier: "stacklok.frizbee"
58+
url_template: "https://github.com/stacklok/frizbee/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
59+
skip_upload: auto
60+
release_notes: "{{.Changelog}}"
61+
tags:
62+
- golang
63+
- cli
64+
commit_author:
65+
name: stacklokbot
66+
email: [email protected]
67+
goamd64: v1
68+
repository:
69+
owner: stacklok
70+
name: winget-pkgs
71+
branch: "frizbee-{{.Version}}"
72+
token: "{{ .Env.WINGET_GITHUB_TOKEN }}"
73+
pull_request:
74+
enabled: true
75+
draft: false
76+
base:
77+
owner: microsoft
78+
name: winget-pkgs
79+
branch: master
80+
# This section defines whether we want to release the source code too.
81+
source:
82+
enabled: true
83+
# This section defines how to generate the changelog
84+
changelog:
85+
sort: asc
86+
use: github
87+
# This section defines for which artifact types to generate SBOMs.
88+
sboms:
89+
- artifacts: archive
90+
# This section defines the release policy.
91+
release:
92+
github:
93+
owner: stacklok
94+
name: frizbee
95+
# This section defines how and which artifacts we want to sign for the release.
96+
signs:
97+
- cmd: cosign
98+
args:
99+
- "sign-blob"
100+
- "--output-signature=${signature}"
101+
- "${artifact}"
102+
- "--yes" # needed on cosign 2.0.0+
103+
artifacts: archive
104+
output: true

0 commit comments

Comments
 (0)