2022-04-09 05:59:24 +02:00
|
|
|
name: SLSA go releaser
|
|
|
|
|
on:
|
|
|
|
|
workflow_dispatch:
|
|
|
|
|
|
|
|
|
|
permissions: read-all
|
|
|
|
|
|
|
|
|
|
jobs:
|
|
|
|
|
# ldflags to embed the commit hash in the binary
|
|
|
|
|
args:
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
outputs:
|
|
|
|
|
ldflags: ${{ steps.ldflags.outputs.value }}
|
|
|
|
|
steps:
|
|
|
|
|
- id: checkout
|
|
|
|
|
uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.3.4
|
|
|
|
|
with:
|
|
|
|
|
fetch-depth: 0
|
|
|
|
|
- id: ldflags
|
|
|
|
|
run: |
|
2022-04-09 06:42:19 +02:00
|
|
|
GIT_HASH=$(git rev-list -1 HEAD)
|
|
|
|
|
echo "-X main.GitCommit=$GIT_HASH -w -extldflags \"-static\""
|
|
|
|
|
|
2022-04-09 05:59:24 +02:00
|
|
|
# Trusted builder.
|
|
|
|
|
build:
|
|
|
|
|
permissions:
|
|
|
|
|
id-token: write
|
|
|
|
|
contents: read
|
|
|
|
|
needs: args
|
|
|
|
|
uses: slsa-framework/slsa-github-generator-go/.github/workflows/builder.yml@main # TODO: use hash upon release.
|
|
|
|
|
with:
|
|
|
|
|
go-version: 1.17
|
|
|
|
|
env: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
|
|
|
|
|
# Upload to GitHub release.
|
|
|
|
|
upload:
|
|
|
|
|
permissions:
|
|
|
|
|
contents: write
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
needs: build
|
|
|
|
|
steps:
|
|
|
|
|
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
|
|
|
|
|
with:
|
|
|
|
|
name: ${{ needs.build.outputs.go-binary-name }}
|
|
|
|
|
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
|
|
|
|
|
with:
|
|
|
|
|
name: ${{ needs.build.outputs.go-binary-name }}.intoto.jsonl
|
|
|
|
|
- name: Release
|
|
|
|
|
uses: softprops/action-gh-release@1e07f4398721186383de40550babbdf2b84acfc5
|
|
|
|
|
with:
|
|
|
|
|
files: |
|
|
|
|
|
${{ needs.build.outputs.go-binary-name }}
|
|
|
|
|
${{ needs.build.outputs.go-binary-name }}.intoto.jsonl
|
