Merge pull request #81 from thegalactiks/goreleaser-sbom

Goreleaser SBOM

.github/workflows/publish.yml

@@ -15,6 +15,7 @@ jobs:
 
     permissions:
       contents: write
+      id-token: write
       packages: write
       pull-requests: write
 
@@ -43,6 +44,12 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3
+
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@v0
+
       - uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser

.goreleaser.yaml

@@ -1,3 +1,7 @@
+version: 2
+
+project_name: giteway
+
 before:
   hooks:
     - go mod tidy
@@ -8,6 +12,17 @@ builds:
       - CGO_ENABLED=0
     goos:
       - linux
+      - windows
+      - darwin
+
+gomod:
+  proxy: true
+
+checksum:
+  name_template: 'checksums.txt'
+
+source:
+  enabled: true
 
 archives:
   - format: tar.gz
@@ -23,15 +38,34 @@ archives:
     - goos: windows
       format: zip
 
-checksum:
-  name_template: 'checksums.txt'
+snapshot:
+  name_template: "{{ incpatch .Version }}-next"
+
+sboms:
+  - id: syft-archive
+    artifacts: archive
+
+signs:
+  - cmd: cosign
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    certificate: "${artifact}.pem"
+    args:
+      - sign-blob
+      - "--output-certificate=${certificate}"
+      - "--output-signature=${signature}"
+      - "${artifact}"
+      - "--yes"
+    artifacts: checksum
+    output: true
 
 changelog:
   sort: asc
   filters:
     exclude:
       - "^docs:"
-      - "^test:"
+      - "^.vscode"
+      - "^.github"
 
 dockers:
   - image_templates:
@@ -44,3 +78,14 @@ dockers:
       - "ghcr.io/thegalactiks/giteway:v{{ .Major }}.{{ .Minor }}"
       - "ghcr.io/thegalactiks/giteway:latest"
     dockerfile: .docker/Dockerfile-goreleaser
+
+docker_signs:
+  - cmd: cosign
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    artifacts: images
+    output: true
+    args:
+      - "sign"
+      - "${artifact}"
+      - "--yes"