release.yaml

name: release

on:
  push:
    tags:
      - '*'

permissions:
  id-token: write # Undocumented OIDC support.
  packages: write # To publish container images to GHCR
  contents: write # To create a release

jobs:
  release:
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: '1.21'
          check-latest: true

      - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - uses: ko-build/setup-ko@3aebd0597dc1e9d1a26bcfdb7cbeb19c131d3037 # v0.7

      - run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.workflow }} --password-stdin

      - run: ko publish -B ./cmd/allstar --tags ${{ github.ref_name }} --image-refs allstar.ref
        env:
          KO_DOCKER_REPO: ghcr.io/${{ github.repository_owner }}
          KO_DEFAULTPLATFORMS: linux/arm64,linux/amd64
      - run: ko publish -B ./cmd/allstar --tags ${{ github.ref_name }}-busybox --image-refs allstar-busybox.ref
        env:
          KO_DOCKER_REPO: ghcr.io/${{ github.repository_owner }}
          KO_DEFAULTBASEIMAGE: cgr.dev/chainguard/busybox
          KO_DEFAULTPLATFORMS: linux/arm64,linux/amd64
      - run: |
          echo "signing $(cat allstar.ref)"
          cosign sign --yes -a git_sha="$GITHUB_SHA" "$(cat allstar.ref)"
          echo "signing $(cat allstar-busybox.ref)"
          cosign sign --yes -a git_sha="$GITHUB_SHA" "$(cat allstar-busybox.ref)"

      - run: |
          gh release create ${{ github.ref_name }} --notes "Images:
          * ghcr.io/${{ github.repository_owner }}/allstar:${{ github.ref_name }}
          * ghcr.io/${{ github.repository_owner }}/allstar:${{ github.ref_name }}-busybox"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}