.goreleaser.yml

project_name: cosign-gatekeeper-provider

env:
  - GO111MODULE=on
  - CGO_ENABLED=1
  - DOCKER_CLI_EXPERIMENTAL=enabled
  - COSIGN_EXPERIMENTAL=true

# Prevents parallel builds from stepping on each others toes downloading modules
before:
  hooks:
    - go mod tidy
    - /bin/bash -c 'if [ -n "$(git --no-pager diff --exit-code go.mod go.sum)" ]; then exit 1; fi'

gomod:
  proxy: true

sboms:
  - artifacts: binary

builds:
  - main: .
    flags:
      - -trimpath
    mod_timestamp: '{{ .CommitTimestamp }}'
    binary: cosign-gatekeeper-provider-{{ .Os }}-{{ .Arch }}
    goos:
      - linux
      - darwin
    goarch:
      - amd64
      - arm64
      - arm
      - s390x
      - ppc64le
    goarm:
      - '7'
    env:
      - CGO_ENABLED=0

kos:
  - repository: ghcr.io/sigstore/cosign-gatekeeper-provider
    tags:
      - 'v{{.Version}}'
    main: .
    bare: true
    preserve_import_paths: false
    sbom: spdx
    base_image: cgr.dev/chainguard/static:latest
    platforms:
      - linux/amd64
      - linux/arm64
      - linux/s390x
      - linux/ppc64le
      - linux/arm

signs:
  # Keyless
  - id: binary
    signature: "${artifact}.sig"
    certificate: "${artifact}.pem"
    cmd: cosign
    args: ["sign-blob", "--output-signature", "${artifact}.sig", "--output-certificate", "${artifact}.pem", "${artifact}"]
    artifacts: binary
  - id: checksum-keyless
    signature: "${artifact}.sig"
    certificate: "${artifact}.pem"
    cmd: cosign
    args: ["sign-blob", "--output-signature", "${artifact}.sig", "--output-certificate", "${artifact}.pem", "${artifact}"]
    artifacts: checksum

archives:
  - format: binary
    name_template: "{{ .Binary }}"
    allow_different_binary_count: true

checksum:
  name_template: "{{ .ProjectName }}_checksums.txt"

snapshot:
  name_template: latest

release:
  prerelease: allow # remove this when we start publishing non-prerelease or set to auto
  draft: true # allow for manual edits
  github:
    owner: sigstore
    name: cosign-gatekeeper-provider
  footer: |
    ### Thanks for all contributors!