.goreleaser.yaml

# Copyright 2023 The OpenVEX Authors
# SPDX-License-Identifier: Apache-2.0

project_name: vexctl

env:
  - GO111MODULE=on
  - COSIGN_YES=true

before:
  hooks:
    - go mod tidy
    - /bin/bash -c 'if [ -n "$(git --no-pager diff --exit-code go.mod go.sum)" ]; then exit 1; fi'

gomod:
  proxy: true

builds:
  - id: binaries
    binary: vexctl-{{ .Os }}-{{ .Arch }}
    no_unique_dist_dir: true
    main: .
    flags:
      - -trimpath
    mod_timestamp: '{{ .CommitTimestamp }}'
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
      - arm
      - s390x
      - ppc64le
    goarm:
      - '7'
    ignore:
      - goos: windows
        goarch: arm64
      - goos: windows
        goarch: arm
      - goos: windows
        goarch: s390x
      - goos: windows
        goarch: ppc64le
    ldflags:
      - "{{ .Env.LDFLAGS }}"
    env:
      - CGO_ENABLED=0

signs:
  - id: vexctl-keyless
    signature: "${artifact}.sig"
    certificate: "${artifact}.pem"
    cmd: cosign
    args: ["sign-blob", "--output-signature", "${artifact}.sig", "--output-certificate", "${artifact}.pem", "${artifact}"]
    artifacts: all

archives:
  - format: binary
    name_template: "{{ .Binary }}"
    allow_different_binary_count: true

sboms:
  - id: vexctl
    cmd: bom
    args:
      - generate
      - "--output"
      - "vexctl-bom.json.spdx"
      - "-d"
      - "../"
      - "-c"
      - "../.vexctl-bom-config.yaml"
      - "--format"
      - "json"
    artifacts: any
    documents:
      - "vexctl-bom.json.spdx"

checksum:
  name_template: "{{ .ProjectName }}_checksums.txt"

snapshot:
  name_template: SNAPSHOT-{{ .ShortCommit }}

release:
  prerelease: auto

changelog:
  use: github-native