.goreleaser.yaml

# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
version: 2

project_name: privatebin

before:
  hooks:
    - make man
    - go mod vendor

builds:
  - id: privatebin
    main: ./cmd/privatebin
    binary: privatebin
    ldflags:
      - -s -w
      - -X 'main.version={{.Version}}'
      - -X 'main.commit={{.ShortCommit}}'
      - -X 'main.date={{.Date}}'
    gcflags:
      - -e
    flags:
      - -trimpath
      - -mod=readonly
    env:
      - CGO_ENABLED=0
    goos:
      - windows
      - darwin
      - freebsd
      - openbsd
    goarch:
      - amd64
      - arm
      - arm64
    goarm:
      - "6"
      - "7"
    ignore:
      - goos: windows
        goarch: arm
      - goos: darwin
        goarch: arm
  # Docker-specific builds for Linux only
  - id: privatebin-docker
    main: ./cmd/privatebin
    binary: privatebin
    ldflags:
      - -s -w
      - -X 'main.cliVersion={{.Version}}'
      - -X 'main.commit={{.ShortCommit}}'
      - -X 'main.date={{.Date}}'
    gcflags:
      - -e
    flags:
      - -trimpath
      - -mod=readonly
    env:
      - CGO_ENABLED=0
    goos:
      - linux
    goarch:
      - amd64
      - arm64

archives:
  - name_template: >-
      {{ .ProjectName }}_
      {{- title .Os }}_
      {{- if eq .Arch "amd64" }}x86_64
      {{- else if eq .Arch "386" }}i386
      {{- else }}{{ .Arch }}{{ end }}
      {{- if .Arm }}v{{ .Arm }}{{ end }}
    files:
      - LICENSE.txt
      - README.md
      - CHANGELOG.md
      - man/*

source:
  enabled: true
  name_template: "{{ .Tag }}-source"
  format: tar.gz
  files:
    - vendor
    - man

checksum:
  name_template: "checksums.txt"
  algorithm: sha512

sboms:
  - artifacts: archive
    documents:
      - "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}_sbom.json"
    cmd: syft
    args:
      - "dir:."
      - "--output=cyclonedx-json={{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}_sbom.json"
      - "--source-name={{ .ProjectName }}"
      - "--source-version={{ .Version }}"

signs:
  - cmd: sh
    env:
      - COSIGN_EXPERIMENTAL=1
    certificate: "${artifact}.pem"
    args:
      - -c
      - |
        if [ "{{ .IsSnapshot }}" = "true" ]; then
          echo "Skipping signing (snapshot: {{ .IsSnapshot }})"
        else
          cosign sign-blob --output-certificate="${certificate}" --output-signature="${signature}" "${artifact}" --yes
        fi
    artifacts: checksum
    output: true

dockers_v2:
  - images:
      - "ghcr.io/gearnode/privatebin"
    tags:
      - "{{ .Tag }}"
      - latest
    ids:
      - privatebin-docker
    platforms:
      - linux/amd64
      - linux/arm64
    labels:
      "org.opencontainers.image.title": "{{.ProjectName}}"
      "org.opencontainers.image.description": "A CLI for PrivateBin"
      "org.opencontainers.image.url": "https://github.com/gearnode/privatebin"
      "org.opencontainers.image.source": "https://github.com/gearnode/privatebin"
      "org.opencontainers.image.version": "{{.Version}}"
      "org.opencontainers.image.created": '{{time "2006-01-02T15:04:05Z07:00"}}'
      "org.opencontainers.image.revision": "{{.FullCommit}}"
      "org.opencontainers.image.licenses": "ISC"

docker_signs:
  - id: images
    cmd: sh
    env:
      - COSIGN_EXPERIMENTAL=1
    artifacts: images
    output: true
    args:
      - -c
      - |
        if [ "{{ .IsSnapshot }}" = "true" ]; then
          echo "Skipping Docker image signing (snapshot: {{ .IsSnapshot }})"
        else
          cosign sign "${artifact}@${digest}" --yes
        fi
  - id: manifests
    cmd: sh
    env:
      - COSIGN_EXPERIMENTAL=1
    artifacts: manifests
    output: true
    args:
      - -c
      - |
        if [ "{{ .IsSnapshot }}" = "true" ]; then
          echo "Skipping Docker manifest signing (snapshot: {{ .IsSnapshot }})"
        else
          cosign sign "${artifact}@${digest}" --yes
        fi

changelog:
  use: github
  sort: asc

release:
  github:
    owner: gearnode
    name: privatebin
  draft: true
  prerelease: auto
  mode: replace
  header: |
    ## privatebin {{ .Tag }}

    Release date: {{ .Date }}
  footer: |
    ---

    ## Docker Images
    - `ghcr.io/gearnode/privatebin:{{ .Tag }}` (multi-arch: linux/amd64, linux/arm64)
    - `ghcr.io/gearnode/privatebin:latest` (multi-arch: linux/amd64, linux/arm64)

    ### Architecture-specific images
    - `ghcr.io/gearnode/privatebin:{{ .Tag }}-amd64`
    - `ghcr.io/gearnode/privatebin:{{ .Tag }}-arm64`

    **Full Changelog**: https://github.com/gearnode/privatebin/compare/{{ .PreviousTag }}...{{ .Tag }}

    **Installation**: See the [README](https://github.com/gearnode/privatebin#installation) for installation instructions.

    **Verification**: All artifacts and Docker images are signed with Cosign. Use `cosign verify-blob` for files or `cosign verify` for container images.