.goreleaser.yaml

project_name: witness
builds:
  - ldflags:
      - "-s -w"
      - "-extldflags=-zrelro"
      - "-extldflags=-znow"
      - "-extldflags -w -X 'github.com/in-toto/witness/cmd.Version={{.Tag}}-{{.ShortCommit}}'"
    env:
      - "CGO_ENABLED=0"
      - "GO111MODULE=on"
      - "GOFLAGS=-mod=readonly -trimpath"
    goos:
      - linux
      - windows
      - darwin
    goarch:
      - amd64
      - arm64
    main: ./
gomod:
  proxy: false
source:
  enabled: true
signs:
  - cmd: cosign
    certificate: '${artifact}.pem'
    signature: '${artifact}.sig'
    args:
      - "sign-blob"
      - "--output-signature=${signature}"
      - '--output-certificate=${certificate}'
      - "${artifact}"
      - "--yes" # needed on cosign 2.0.0+
    artifacts: all
changelog:
  use: github
  groups:
    - title: Features
      regexp: "^.*feat[(\\w)]*:+.*$"
      order: 0
    - title: 'Bug fixes'
      regexp: "^.*fix[(\\w)]*:+.*$"
      order: 1
    - title: 'Documentation'
      regexp: "^.*docs[(\\w)]*:+.*$"
      order: 2
    - title: Others
      order: 999
release:
  prerelease: auto
  github:
    owner: "{{ .Env.GITHUB_REPOSITORY_OWNER }}"
kos:
  - repository: ghcr.io/in-toto/witness
    tags:
    - '{{.Version}}'
    bare: true
    preserve_import_paths: false
    creation_time: '{{.CommitTimestamp}}'
    platforms:
    - linux/amd64
    - linux/arm64
    sbom: spdx
docker_signs:
  - artifacts: manifests
    cmd: cosign
    args:
      - "sign"
      - "${artifact}"
      - "--yes" # needed on cosign 2.0.0+
sboms:
  - id: archive
    cmd: syft
    artifacts: archive
    args: ["$artifact", "--output", "spdx-json=$document"]
  - id: source
    cmd: syft
    artifacts: source
    args: ["$artifact", "--output", "spdx-json=$document"]