release.yml

name: Release binary builder

on: # yamllint disable-line rule:truthy
  release:
    types: [published]

permissions:
  attestations: write
  contents: write
  id-token: write
  packages: write

jobs:
  action-image:
    name: Publish Docker Action
    if: ${{ !github.event.release.prerelease }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Build and push Action image
        id: action_image
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
          docker buildx create --name action-builder --use
          docker buildx build \
            --platform linux/amd64,linux/arm64 \
            --tag "ghcr.io/dependabot/cli-action:$RELEASE_TAG" \
            --tag ghcr.io/dependabot/cli-action:v1 \
            --metadata-file "$RUNNER_TEMP/action-image.json" \
            --push .
          echo "digest=$(jq -r '."containerimage.digest"' "$RUNNER_TEMP/action-image.json")" >> "$GITHUB_OUTPUT"

      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ghcr.io/dependabot/cli-action
          subject-digest: ${{ steps.action_image.outputs.digest }}
          push-to-registry: true

  releases-matrix:
    name: Release Go Binary
    runs-on: ubuntu-latest
    strategy:
      matrix:
        goos: [linux, windows, darwin]
        goarch: ["386", amd64, arm64]
        exclude:
          - goarch: "386"
            goos: darwin
          - goarch: arm64
            goos: windows
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.55
        id: go_release
        with:
          goversion: go.mod
          github_token: ${{ secrets.GITHUB_TOKEN }}
          goos: ${{ matrix.goos }}
          goarch: ${{ matrix.goarch }}
          binary_name: dependabot
          project_path: cmd/dependabot
          ldflags: >-
            -X github.com/dependabot/cli/cmd/dependabot/internal/cmd.version=${{ github.event.release.tag_name }}

      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            ${{ steps.go_release.outputs.release_asset_dir }}/*
            cmd/dependabot/dependabot-${{ github.ref_name}}-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
            cmd/dependabot/dependabot-${{ github.ref_name}}-${{ matrix.goos }}-${{ matrix.goarch }}.zip