Repository navigation
Expand file tree
/
Copy path.goreleaser.yaml
More file actions
181 lines (168 loc) · 6.04 KB
/
Copy path.goreleaser.yaml
File metadata and controls
181 lines (168 loc) · 6.04 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
# GoReleaser configuration for basecamp
# Docs: https://goreleaser.com
version: 2
project_name: basecamp
before:
hooks:
- sh -c 'mkdir -p completions && go run ./cmd/basecamp completion bash > completions/basecamp.bash && go run ./cmd/basecamp completion zsh > completions/_basecamp && go run ./cmd/basecamp completion fish > completions/basecamp.fish'
- sh -c '{{ if .Prerelease }}echo "Skipping plugin version stamps for prerelease {{ .Version }}"{{ else }}scripts/stamp-plugin-version.sh {{ .Version }} && scripts/stamp-codex-plugin-version.sh {{ .Version }}{{ end }}'
# Authenticode-sign a copy of the PowerShell installer inside the pipeline
# so it lands in checksums.txt (cosign-signed, provenance-attested) and on
# the release as basecamp_installer.ps1. Staged outside dist/ because
# goreleaser requires dist to be empty after before-hooks run. Unsigned
# copy when the SM_* env is absent (forks, make test-release). Raw-main
# install.ps1 stays unsigned and LF -- that is the `irm | iex` path,
# which needs neither. The staging step converts to CRLF and rejects
# non-ASCII, without which PowerShell reports HashMismatch (see the
# script for why both invariants are load-bearing).
- sh -c 'scripts/stage-installer-ps1.sh scripts/install.ps1 .release-extra/basecamp_installer.ps1 && scripts/sign-windows.sh windows .release-extra/basecamp_installer.ps1'
builds:
- id: basecamp
main: ./cmd/basecamp
binary: basecamp
env:
- CGO_ENABLED=0
goos:
- darwin
- linux
- windows
- freebsd
- openbsd
goarch:
- amd64
- arm64
flags:
- -trimpath
ldflags:
- -s -w
- -X github.com/basecamp/basecamp-cli/internal/version.Version={{.Version}}
- -X github.com/basecamp/basecamp-cli/internal/version.Commit={{.Commit}}
- -X github.com/basecamp/basecamp-cli/internal/version.Date={{.Date}}
hooks:
post:
# Authenticode-sign Windows binaries in place before archiving, so the
# zip, checksums.txt, cosign bundle, and provenance attestation all
# cover the signed binary. No-op for non-windows targets and when the
# SM_* signing env is absent (forks, make test-release).
- cmd: scripts/sign-windows.sh "{{ .Target }}" "{{ .Path }}"
output: true
archives:
- id: default
formats:
- tar.gz
name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
format_overrides:
- goos: windows
formats:
- zip
files:
- MIT-LICENSE
- README*
- completions/*
nfpms:
- id: packages
package_name: basecamp-cli
ids: [basecamp]
vendor: 37signals
homepage: "https://github.com/basecamp/basecamp-cli"
maintainer: "37signals <support@37signals.com>"
description: "Command-line interface for Basecamp"
license: MIT
formats:
- deb
- rpm
- apk
contents:
- src: completions/basecamp.bash
dst: /usr/share/bash-completion/completions/basecamp
- src: completions/_basecamp
dst: /usr/share/zsh/vendor-completions/_basecamp
packager: deb
- src: completions/_basecamp
dst: /usr/share/zsh/vendor-completions/_basecamp
packager: apk
- src: completions/_basecamp
dst: /usr/share/zsh/site-functions/_basecamp
packager: rpm
- src: completions/basecamp.fish
dst: /usr/share/fish/vendor_completions.d/basecamp.fish
checksum:
name_template: 'checksums.txt'
algorithm: sha256
extra_files:
- glob: .release-extra/basecamp_installer.ps1
# Generate SBOM for supply chain transparency
sboms:
- artifacts: archive
# Sign checksums with cosign (keyless via Sigstore)
# Requires: permissions.id-token: write in workflow for OIDC
signs:
- cmd: cosign
signature: '${artifact}.bundle'
args:
- sign-blob
- '--bundle=${signature}'
# Pin the published bundle format explicitly (protobuf, v0.3+json) so it
# no longer depends on the CI cosign default. Installers and `basecamp
# upgrade` verify this format; cosign v3 defaults to it anyway.
- '--new-bundle-format=true'
- '${artifact}'
- '--yes'
artifacts: checksum
output: true
# Sign and notarize macOS binaries (cross-platform via embedded quill)
notarize:
macos:
- enabled: '{{ and (ne .Env.MACOS_SIGN_P12 "") (ne .Env.MACOS_SIGN_PASSWORD "") (ne .Env.MACOS_NOTARY_KEY "") (ne .Env.MACOS_NOTARY_KEY_ID "") (ne .Env.MACOS_NOTARY_ISSUER_ID "") }}'
ids:
- basecamp
sign:
certificate: "{{.Env.MACOS_SIGN_P12}}"
password: "{{.Env.MACOS_SIGN_PASSWORD}}"
notarize:
issuer_id: "{{.Env.MACOS_NOTARY_ISSUER_ID}}"
key_id: "{{.Env.MACOS_NOTARY_KEY_ID}}"
key: "{{.Env.MACOS_NOTARY_KEY}}"
wait: true
timeout: 20m
changelog:
# Use GitHub's auto-generated release notes (categories configured in .github/release.yml)
use: github-native
release:
github:
owner: basecamp
name: basecamp-cli
draft: false
prerelease: auto
make_latest: "{{ if .Prerelease }}false{{ else }}auto{{ end }}"
replace_existing_artifacts: true
extra_files:
- glob: .release-extra/basecamp_installer.ps1
name_template: "{{.ProjectName}} v{{.Version}}"
homebrew_casks:
- name: basecamp-cli
repository:
owner: basecamp
name: homebrew-tap
token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
directory: Casks
homepage: "https://github.com/basecamp/basecamp-cli"
description: "Command-line interface for Basecamp"
binaries:
- basecamp
completions:
bash: "completions/basecamp.bash"
zsh: "completions/_basecamp"
fish: "completions/basecamp.fish"
skip_upload: auto
scoops:
- name: basecamp-cli
repository:
owner: basecamp
name: homebrew-tap
token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
homepage: "https://github.com/basecamp/basecamp-cli"
description: "Command-line interface for Basecamp"
license: MIT
skip_upload: auto
# AUR publishing handled by scripts/publish-aur.sh (GoReleaser enforces -bin suffix)