codeiq/.github/workflows/release-go.yml at main · RandomCodeSpace/codeiq · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
name: release-go

# Tag-triggered release pipeline for the codeiq Go binary (linux/amd64
# + linux/arm64). darwin/arm64 ships from `release-darwin.yml` on the
# same tag.
#
# Trigger: push a tag matching `v*.*.*` (e.g. `git tag v0.3.0 && git push --tags`).
#
# Single ubuntu-latest runner builds both linux archs via
# linux→linux cross-compile with gcc-aarch64-linux-gnu (CGO permits
# this cross — both kuzu and go-sqlite3 build cleanly).

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to release (e.g. v0.3.0). Must already exist.'
        required: true

permissions:
  contents: write
  id-token: write      # Sigstore keyless via GitHub OIDC
  packages: write
  attestations: write

jobs:
  release:
    name: release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: '1.25.10'
          cache: true
          cache-dependency-path: go.sum
      - name: Install build deps
        run: |
          sudo apt-get update -y
          sudo apt-get install -y build-essential gcc-aarch64-linux-gnu
      - name: Install Syft (SBOM)
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
      - name: Install Cosign (signing)
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7.2.1
        with:
          distribution: goreleaser
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Attest release artifacts (build provenance)
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-path: 'dist/codeiq_*.tar.gz'