release.yml

name: goreleaser

on:
  push:
    branches:
      - main
    tags:
      # Create a release on a tag push
      - "*"
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref_name != 'main' }}

permissions:
  contents: write
  # packages: write
  # issues: write

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: true
      -
        name: Fetch all tags
        run: git fetch --force --tags
      
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.22"
    
      - name: Print Go version
        run: go version
      
      - name: Print supported platforms
        run: go tool dist list

      - name: Install syft
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
          syft version

      - name: Set ui_file
        id: vars
        run: |
          echo "ui_file=$(pwd)/.tmp/ui.tar.gz" >> $GITHUB_OUTPUT
      
      - name: Set args for goreleaser
        id: args
        run: |
          if ${{ github.ref_type == 'tag' }} ; then
            echo "args=release --clean" >> $GITHUB_OUTPUT
          else
            echo "args=release --clean --skip=validate --skip=publish" >> $GITHUB_OUTPUT
          fi
          
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          # either 'goreleaser' (default) or 'goreleaser-pro'
          distribution: goreleaser
          version: "~> v2"
          args: ${{ steps.args.outputs.args }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          UI_SEPARATOR: "--------UI--------"
          UI_FILE: ${{ steps.vars.outputs.ui_file }}
          # Your GoReleaser Pro key, if you are using the 'goreleaser-pro' distribution
          # GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}

      # Needed for syft to generate SBOM also for npm dependencies
      - name: Install npm
        uses: actions/setup-node@v4
        with:
          node-version: 18
      - name: Get npm dependencies
        run: |
          cd web
          npm install

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          path: .
          artifact-name: sbom.spdx.json
          upload-artifact-retention: 14