ghasec/.github/workflows/release-please.yml at 0d5129f522dfb7c6b53e2a273e26bf0a19e48eda · koki-develop/ghasec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: Release Please

permissions: {}

on:
  push:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release-please:
    timeout-minutes: 10
    runs-on: ubuntu-latest
    permissions:
      contents: write # for create a release
      pull-requests: write # for open a pull request
      issues: write # for create labels
    outputs:
      should-release: ${{ steps.release-please.outputs.release_created }}
      version: ${{ steps.release-please.outputs.version }}
      tag-name: ${{ steps.release-please.outputs.tag_name }}
    steps:
      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
        id: release-please
        with:
          token: ${{ github.token }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

  release:
    if: ${{ needs.release-please.outputs.should-release == 'true' }}
    timeout-minutes: 10
    needs: release-please
    runs-on: ubuntu-latest
    permissions:
      contents: write # for upload release assets
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
          persist-credentials: false
          submodules: true
      - uses: ./.github/actions/setup

      - run: goreleaser release --clean
        env:
          GITHUB_TOKEN: ${{ github.token }}

  homebrew-tap:
    if: ${{ needs.release-please.outputs.should-release == 'true' }}
    timeout-minutes: 10
    needs:
      - release-please
      - release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - run: go run ./cmd/formula -version "${VERSION}" > ghasec.rb
        env:
          VERSION: ${{ needs.release-please.outputs.version }}

      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          app-id: ${{ secrets.HOMEBREW_TAP_APP_ID }}
          private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: homebrew-tap
          permission-contents: write # for updating files
      - name: Update Homebrew Formula
        run: |
          SHA=$(gh api repos/koki-develop/homebrew-tap/contents/Formula/ghasec.rb --jq '.sha')
          gh api --method PUT repos/koki-develop/homebrew-tap/contents/Formula/ghasec.rb \
            --field message="chore: update ghasec to $TAG" \
            --field content=@<(base64 -i ./ghasec.rb) \
            --field sha="$SHA"
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          TAG: ${{ needs.release-please.outputs.tag-name }}

  docker-push:
    needs:
      - release-please
      - release
    if: ${{ needs.release-please.outputs.should-release == 'true' }}
    timeout-minutes: 30
    runs-on: ubuntu-latest
    permissions:
      packages: write # for publish a package to GitHub Packages
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0

      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: ghcr.io/koki-develop/ghasec
          tags: |
            type=semver,pattern={{version}},value=${{ needs.release-please.outputs.tag-name }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.release-please.outputs.tag-name }}
            type=semver,pattern={{major}},value=${{ needs.release-please.outputs.tag-name }}
            type=sha,format=long,prefix=
            type=raw,value=latest

      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            GHASEC_VERSION=${{ needs.release-please.outputs.version }}
          cache-from: type=gha,scope=release
          cache-to: type=gha,scope=release,mode=max