wip

.github/workflows/release.yml

@@ -12,17 +12,35 @@ permissions:
 
 jobs:
   goreleaser:
-    runs-on: windows-latest
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
         with:
           fetch-depth: 0
       - uses: actions/setup-go@v4
         with:
           go-version: "stable"
-      - run: "choco install syft -y"
-        shell: powershell
-      - run: "./goreleaser.exe release --clean --verbose -f .goreleaser.4.yml --skip-validate"
-        shell: powershell
+      - uses: goreleaser/goreleaser-action@v6
+        id: goreleaser
+        with:
+          version: latest
+          args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # parse artifacts to the format required for image attestation
+      - run: |
+          echo "digest=$(echo "$ARTIFACTS" | jq -r '.[]|select(.type=="Docker Manifest")|select(.name|test(":v"))|.extra.Digest')" >> "$GITHUB_OUTPUT"
+          echo "name=$(echo "$ARTIFACTS" | jq -r '.[]|select(.type=="Docker Manifest")|select(.name|test(":v"))|.name|split(":")[0]')" >> "$GITHUB_OUTPUT"
+        id: image_metadata
+        env:
+          ARTIFACTS: ${{steps.goreleaser.outputs.artifacts}}
+      # attest archives
+      - uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: "dist/*.tar.gz"
+      # attest image
+      - uses: actions/attest-build-provenance@v1
+        with:
+          subject-digest: ${{steps.image_metadata.outputs.digest}}
+          subject-name: ${{steps.image_metadata.outputs.name}}
+          push-to-registry: true

.goreleaser.4.yml

@@ -1,3 +1,4 @@
+version: 2
 # yaml-language-server: $schema=https://goreleaser.com/static/schema-pro.json
 # This is an example goreleaser.yaml file with some sane defaults.
 # Make sure to check the documentation at http://goreleaser.com
@@ -34,7 +35,7 @@ brews:
       pull_request:
         base: master
         enabled: true
-        check_boxes: true
+        # check_boxes: true
       branch: foo
 
 release: