vet-mcp

name: Release Automation

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"

concurrency: ci-release-automation

permissions:
  contents: read

env:
  OSX_CROSS_TOOLCHAIN_REPOSITORY: https://github.com/abhisek/osxcross
  OSX_CROSS_MACOS_SDK_VERSION: "12.3"

jobs:
  goreleaser:
    timeout-minutes: 60
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    permissions:
      contents: write # for goreleaser/goreleaser-action to create a GitHub release
      packages: write # for goreleaser/goreleaser-action to publish docker images
    runs-on: ubuntu-latest
    env:
      # Required for buildx on docker 19.x
      DOCKER_CLI_EXPERIMENTAL: "enabled"
    steps:
      - name: Checkout
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
        with:
          fetch-depth: 0
      - uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2
      - uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2
      - name: Set up Go
        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
        with:
          go-version-file: go.mod
          check-latest: true
      - name: ghcr-login
        uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 # v1
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install OSX Cross Compiler Build Tools
        run: sudo apt-get install -y -qq build-essential clang gcc g++ gcc-mingw-w64 zlib1g-dev libmpc-dev libmpfr-dev libgmp-dev cmake libxml2-dev libssl-dev xz-utils gcc-aarch64-linux-gnu g++-aarch64-linux-gnu

      - name: Setup OSX Cross Compiler Tool Chain Environment
        run: |
          echo "OSXCROSS_DIR=$(dirname $GITHUB_WORKSPACE)/osxcross" >> $GITHUB_ENV
      - name: Clone OSX Cross Compiler Tool Chain
        run: git clone $OSX_CROSS_TOOLCHAIN_REPOSITORY $OSXCROSS_DIR

      - name: Setup Cache for OSX Cross Compiler Tool Chain
        id: osxcross-cache
        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # v3
        with:
          key: ${{ runner.os }}-osxcross-${{ env.OSX_CROSS_MACOS_SDK_VERSION }}
          path: |
            ${{ env.OSXCROSS_DIR }}/target/bin
      - name: Build OSX Cross Compiler Tool Chain
        if: steps.osxcross-cache.outputs.cache-hit != 'true'
        run: |
          cd $OSXCROSS_DIR
          SDK_VERSION=$OSX_CROSS_MACOS_SDK_VERSION UNATTENDED=yes ./build.sh
      - name: Add OSX Cross Compiler Tool Chain to Path
        run: |
          echo "$OSXCROSS_DIR/target/bin" >> $GITHUB_PATH

      - name: Run GoReleaser
        id: run-goreleaser
        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}
      - name: Upload dist folder
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: dist-artifacts
          path: dist/

  provenance:
    needs: [goreleaser]
    permissions:
      actions: read # To read the workflow path.
      id-token: write # To sign the provenance.
      attestations: write # To write attestations
    runs-on: ubuntu-latest
    steps:
      - name: Download dist folder
        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          name: dist-artifacts
          path: dist/

      - name: Attest build provenance (checksums)
        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
        with:
          subject-checksums: dist/checksums.txt