mirror of
https://github.com/trufflesecurity/trufflehog.git
synced 2026-06-15 13:24:37 +00:00
Jeff Ober
6171fa9f66
Also adds comments to: - .goreleaser.yml: explains why make_release is set to false - .github/workflows/release.yml: document release/artifact state at each step
97 lines
3.6 KiB
YAML
97 lines
3.6 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- v*
|
|
|
|
permissions:
|
|
contents: write
|
|
packages: write
|
|
id-token: write
|
|
|
|
jobs:
|
|
Release:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
DOCKER_CLI_EXPERIMENTAL: "enabled"
|
|
steps:
|
|
# Setup steps - no external side effects.
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
- name: Docker Login to DockerHub
|
|
uses: docker/login-action@v3
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
- name: Docker Login to GitHub Container Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.repository_owner }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.24"
|
|
- name: Cosign install
|
|
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
|
|
- name: Install UPX
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y upx
|
|
|
|
# GoReleaser pipeline (sequential, not atomic):
|
|
# 1. build + archive + checksum + sign (local only, no side effects)
|
|
# 2. homebrew tap update (commit to trufflesecurity/homebrew-trufflehog)
|
|
# 3. docker images + manifests (DockerHub + GHCR, including :latest tags)
|
|
# 4. github release creation (artifacts uploaded, make_latest: false)
|
|
#
|
|
# On failure: GoReleaser does not roll back completed phases. Depending
|
|
# on where it failed, some subset of the above may have been published.
|
|
# Check:
|
|
# - Homebrew tap: https://github.com/trufflesecurity/homebrew-trufflehog
|
|
# - DockerHub: https://hub.docker.com/r/trufflesecurity/trufflehog/tags
|
|
# - GHCR: https://github.com/trufflesecurity/trufflehog/pkgs/container/trufflehog
|
|
# - GH releases: https://github.com/trufflesecurity/trufflehog/releases
|
|
#
|
|
# If the GitHub release was created but artifacts are missing, the
|
|
# install script (scripts/install.sh) will fail for users on that
|
|
# version. The release is NOT marked latest (make_latest: false), so
|
|
# /releases/latest still points to the previous good release.
|
|
- name: Run GoReleaser
|
|
uses: goreleaser/goreleaser-action@v6
|
|
with:
|
|
distribution: goreleaser-pro
|
|
version: latest
|
|
args: release --clean
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
|
|
GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
|
|
|
|
# Promotes the GitHub release to "latest" only after the Release job fully
|
|
# succeeds (including post-steps). At this point, all artifacts have been
|
|
# published: Docker images and :latest tags are live, the Homebrew tap is
|
|
# updated, binaries are attached to the GitHub release, and checksums are
|
|
# signed.
|
|
#
|
|
# If this job fails, the release exists with all artifacts but is not flagged
|
|
# as latest. /releases/latest and scripts/install.sh still point to the
|
|
# previous release. To manually promote:
|
|
# gh release edit <tag> --latest --repo trufflesecurity/trufflehog
|
|
mark-latest:
|
|
needs: Release
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Mark release as latest
|
|
run: gh release edit "$TAG" --latest
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG: ${{ github.ref_name }}
|