gitsign.yaml

package:
  name: gitsign
  version: 0.11.0
  epoch: 2
  description: Keyless Git signing with Sigstore!
  copyright:
    - license: Apache-2.0

environment:
  environment:
    CGO_ENABLED: "0"

pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/sigstore/gitsign/
      tag: v${{package.version}}
      expected-commit: 8e08985029f0c0e5f0603d20c21864a3a97316cc

  - uses: go/bump
    with:
      deps: "github.com/golang-jwt/jwt/v4@v4.5.1 golang.org/x/crypto@v0.31.0"

  - uses: go/build
    with:
      packages: .
      output: gitsign
      ldflags: |
        -s -w
        -extldflags=-znow
        -extldflags=-zrelro
        -X github.com/sigstore/gitsign/pkg/version.gitVersion=${{package.version}}

  - uses: strip

subpackages:
  - name: gitsign-credential-cache
    description: "helper binary that allows users to cache signing credentials"
    pipeline:
      - uses: go/build
        with:
          packages: ./cmd/gitsign-credential-cache
          output: gitsign-credential-cache
      - uses: strip
    test:
      pipeline:
        - runs: |
            gitsign-credential-cache --version

  - name: "${{package.name}}-config"
    description: "GitSign config"
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/etc/
          git config --system commit.gpgsign true       # Sign all commits
          git config --system tag.gpgsign true          # Sign all tags
          git config --system gpg.x509.program gitsign  # Use gitsign for signing
          git config --system gpg.format x509           # gitsign expects x509 args
          cp /etc/gitconfig ${{targets.subpkgdir}}/etc

update:
  enabled: true
  github:
    identifier: sigstore/gitsign
    strip-prefix: v