release.yaml

name: release

on:
  push:
    # run only against tags
    tags:
      - '*'

permissions:
  contents: write
  packages: write
  # issues: write
  id-token: write


jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Fetch all tags
        run: git fetch --force --tags

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set up Syft
        uses: anchore/sbom-action/download-syft@v0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.20"
      - name: mod download
        run: go mod download && go build

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: us-east-1
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v5
        with:
          distribution: goreleaser
          version: latest
          args: release --clean
        env:
          # this needs push access to the tap
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}

      - name: Push Docker
        run: scripts/deploy-docker --push

      - name: Put Sops on S3
        run: scripts/deploy-sops