goose/.github/workflows/release.yml at main · aaif-goose/goose · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
# This workflow is main release, needs to be manually tagged & pushed.
on:
  push:
    paths-ignore:
      - "documentation/**"
    tags:
      - "v1.*"

name: Release

permissions:
  id-token: write   # Required for Sigstore OIDC signing and AWS OIDC (Windows signing)
  contents: write   # Required for creating releases and by actions/checkout
  actions: read     # May be needed for some workflows
  pull-requests: write  # Required for npm publish workflow
  attestations: write  # Required for SLSA build provenance attestations

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ------------------------------------
  # 1) Build CLI for multiple OS/Arch
  # ------------------------------------
  build-cli:
    uses: ./.github/workflows/build-cli.yml

  # ------------------------------------
  # 2) Upload Install CLI Script
  # ------------------------------------
  install-script:
    name: Upload Install Script
    runs-on: ubuntu-latest
    needs: [build-cli]
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
        with:
          name: download_cli.sh
          path: download_cli.sh

  # ------------------------------------------------------------
  # 3) Bundle Desktop App (macOS)
  # ------------------------------------------------------------
  bundle-desktop:
    uses: ./.github/workflows/bundle-desktop.yml
    permissions:
      id-token: write
      contents: read
    with:
      signing: true
      environment: signing
    secrets: inherit

  # ------------------------------------------------------------
  # 4) Bundle Desktop App (macOS)
  # ------------------------------------------------------------
  bundle-desktop-intel:
    uses: ./.github/workflows/bundle-desktop-intel.yml
    permissions:
      id-token: write
      contents: read
    with:
      signing: true
      environment: signing
    secrets: inherit

  # ------------------------------------------------------------
  # 5) Bundle Desktop App (Linux)
  # ------------------------------------------------------------
  bundle-desktop-linux:
    uses: ./.github/workflows/bundle-desktop-linux.yml

#  # ------------------------------------------------------------
#  # 6) Bundle Desktop App (Windows)
#  # ------------------------------------------------------------
  bundle-desktop-windows:
    uses: ./.github/workflows/bundle-desktop-windows.yml
    permissions:
      id-token: write
      contents: read
      actions: read
    with:
      signing: true
    secrets: inherit

  # ------------------------------------
  # 7) Create/Update GitHub Release
  # ------------------------------------
  release:
    name: Release
    runs-on: ubuntu-latest
    needs: [build-cli, install-script, bundle-desktop, bundle-desktop-intel, bundle-desktop-linux, bundle-desktop-windows]
    permissions:
      contents: write
      id-token: write      # Required for Sigstore OIDC signing
      attestations: write  # Required for SLSA build provenance attestations
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
        with:
          merge-multiple: true

      - name: Attest build provenance
        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f  # v3.2.0
        with:
          subject-path: |
            goose-*.tar.bz2
            goose-*.tar.gz
            goose-*.zip
            Goose*.zip
            *.deb
            *.rpm
            *.flatpak
            download_cli.sh

      # Create/update the versioned release
      - name: Release versioned
        uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b  # v1.20.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: |
            goose-*.tar.bz2
            goose-*.tar.gz
            goose-*.zip
            Goose*.zip
            *.deb
            *.rpm
            *.flatpak
            download_cli.sh
          allowUpdates: true
          omitBody: true
          omitPrereleaseDuringUpdate: true

      # Create/update the stable release
      - name: Release stable
        uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b  # v1.20.0
        with:
          tag: stable
          name: Stable
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: |
            goose-*.tar.bz2
            goose-*.tar.gz
            goose-*.zip
            Goose*.zip
            *.deb
            *.rpm
            *.flatpak
            download_cli.sh
          allowUpdates: true
          omitBody: true
          omitPrereleaseDuringUpdate: true