release-builder.yml

name: Build and upload release artifact

permissions:
  contents: read

on:
  release:
    types: [created]

env:
  RELEASE_VERSION: ${{ github.event.release.tag_name }}

jobs:
  build:
    permissions:
      contents: write

    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

      - name: Set Release Version
        run: echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV

      - name: Set up Go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version: '1.22.4'

      - name: Install Cosign
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
        with:
          cosign-release: 'v2.4.0'

      - name: Check cosign version
        run: cosign version

      - name: Build
        run: |
          set -e
          BUILD=$(git log --format='%H' -n 1)
          VERSION=$RELEASE_VERSION
          OSES="linux darwin windows"
          ARCHS="amd64 arm64"
          IFS=" "
          
          for OS in $OSES; do
          for ARCH in $ARCHS; do
          echo "OS: ${OS} and ARCH: ${ARCH}"
          CGO_ENABLED=0 GOOS=${OS} GOARCH=${ARCH} go build -ldflags "-w -s -X github.com/nginxinc/nginx-k8s-supportpkg/pkg/version.Build=$BUILD\
                                                     -X github.com/nginxinc/nginx-k8s-supportpkg/pkg/version.Version=$VERSION"\
                                                     -o release/kubectl-nginx_supportpkg_${VERSION}_${OS}_${ARCH}/kubectl-nginx_supportpkg
          cp LICENSE release/kubectl-nginx_supportpkg_${VERSION}_${OS}_${ARCH}/
          tar czvf release/kubectl-nginx_supportpkg_${VERSION}_${OS}_${ARCH}.tar.gz -C release/kubectl-nginx_supportpkg_${VERSION}_${OS}_${ARCH}/ .
          sha256sum "release/kubectl-nginx_supportpkg_${VERSION}_${OS}_${ARCH}.tar.gz" >> "release/kubectl-nginx_supportpkg_${VERSION}_checksums.txt"
          done; done
          cosign sign-blob "release/kubectl-nginx_supportpkg_${VERSION}_checksums.txt" \
                --output-signature="release/kubectl-nginx_supportpkg_${VERSION}_checksums.txt.sig" \
                --output-certificate="release/kubectl-nginx_supportpkg_${VERSION}_checksums.txt.pem" -y

      - name: Upload release binaries
        uses: alexellis/upload-assets@13926a61cdb2cb35f5fdef1c06b8b591523236d3 # 0.4.1
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          asset_paths: '["./release/*.gz", "./release/*.txt", "./release/*.sig", "./release/*.pem"]'

      - name: Update new version in krew-index
        uses: rajatjindal/krew-release-bot@df3eb197549e3568be8b4767eec31c5e8e8e6ad8 # v0.0.46