Repository navigation
Expand file tree
/
Copy path.goreleaser.yaml
More file actions
163 lines (163 loc) · 5.92 KB
/
Copy path.goreleaser.yaml
File metadata and controls
163 lines (163 loc) · 5.92 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
project_name: toolhive
version: 2
# This section defines the build matrix.
builds:
# id is referenced by notarize.macos.ids below; matches the previous default.
- id: toolhive
env:
- GO111MODULE=on
- CGO_ENABLED=0
flags:
- -trimpath
- -tags=netgo
ldflags:
- "-s -w"
- "-X github.com/stacklok/toolhive/pkg/versions.Version={{ .Env.VERSION }}"
- "-X github.com/stacklok/toolhive/pkg/versions.Commit={{ .Env.COMMIT }}"
- "-X github.com/stacklok/toolhive/pkg/versions.BuildDate={{ .Date }}"
- "-X github.com/stacklok/toolhive/pkg/versions.BuildType=release"
goos:
- linux
- windows
- darwin
goarch:
- amd64
- arm64
main: ./cmd/thv
binary: thv
# Developer ID signature for the macOS binaries. Go's linker emits only an
# ad-hoc one, which carries no Team ID to allowlist. Signing goes through
# GoReleaser's embedded quill, so no macOS runner is needed.
#
# Sign-only: omitting the `notarize` sub-block keeps Apple's notary service off
# the release critical path.
notarize:
macos:
# A flag rather than `isEnvSet "APPLE_CERTIFICATE"`, because an absent GitHub
# secret still sets the variable, to the empty string. Unset means ad-hoc
# binaries, not a failed release.
- enabled: '{{ .Env.MACOS_SIGN_ENABLED }}'
ids:
- toolhive
sign:
certificate: "{{ .Env.APPLE_CERTIFICATE }}"
password: "{{ .Env.APPLE_CERTIFICATE_PASSWORD }}"
# This section defines the release format.
archives:
- formats: [ 'tar.gz' ]
name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
format_overrides:
- goos: windows
formats: [ 'zip' ]
# This section defines how to release to winget.
winget:
- name: thv
publisher: stacklok
license: Apache-2.0
license_url: "https://github.com/stacklok/toolhive/blob/main/LICENSE"
copyright: Stacklok, Inc.
homepage: https://stacklok.com
short_description: 'ToolHive is a lightweight, secure, and fast manager for MCP (Model Context Protocol) servers'
publisher_support_url: "https://github.com/stacklok/toolhive/issues/new/choose"
package_identifier: "stacklok.thv"
url_template: "https://github.com/stacklok/toolhive/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
skip_upload: auto
release_notes: "{{.Changelog}}"
tags:
- golang
- cli
- mcp
- toolhive
- stacklok
- model-context-protocol
- mcp-server
commit_author:
name: stacklokbot
email: info@stacklok.com
goamd64: v1
repository:
owner: stacklok
name: winget-pkgs
branch: "thv-{{.Version}}"
# WINGET_GITHUB_TOKEN must be a *classic* PAT with full `repo` scope, NOT a
# GitHub App installation token or a fine-grained PAT. This publisher pushes
# the branch above to the stacklok/winget-pkgs fork and then opens the
# pull_request below into microsoft/winget-pkgs — a cross-account,
# fork-to-upstream PR. Only a classic PAT can create that PR: App tokens and
# fine-grained PATs are scoped to a single account and cannot open a PR on a
# repo they aren't installed on (403 "Resource not accessible by
# integration"). This is why winget can't reuse the App-token pattern that
# the homebrew/tap uses in .github/workflows/releaser.yml. A 401 "Bad
# credentials" at release time means the PAT expired or was revoked — rotate
# the secret and re-run the job. See the env comment in releaser.yml.
token: "{{ .Env.WINGET_GITHUB_TOKEN }}"
pull_request:
enabled: true
draft: false
base:
owner: microsoft
name: winget-pkgs
branch: master
# This section defines how to release to homebrew.
homebrew_casks:
- name: thv
binaries: [thv]
homepage: 'https://github.com/stacklok/toolhive'
description: 'ToolHive (thv) is a lightweight, secure, and fast manager for MCP (Model Context Protocol) servers'
commit_author:
name: stacklokbot
email: info@stacklok.com
repository:
owner: stacklok
name: homebrew-tap
token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
# Homebrew quarantines cask downloads, and the darwin binaries are signed
# but not notarized, so Gatekeeper would refuse to run them.
#
# Written as a raw postflight_steps stanza because Homebrew deprecated the
# Ruby postflight block that hooks.post.install generates, and GoReleaser's
# install_steps replacement is not in a stable release yet. The body matches
# what install_steps generates. {{staged_path}} is a Homebrew token, escaped
# so GoReleaser's own templating passes it through.
custom_block: |
postflight_steps do
on_macos do
run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{ "{{staged_path}}" }}/thv"]
end
end
# This section defines whether we want to release the source code too.
source:
enabled: true
# This section defines how to generate the changelog
changelog:
sort: asc
use: github
# This section defines for which artifact types to generate SBOMs.
sboms:
- artifacts: archive
# This section defines the release policy.
release:
github:
owner: stacklok
name: toolhive
extra_files:
- glob: build/thv-cli-docs.tar.gz
- glob: build/thv-crds.tar.gz
- glob: build/upstream-registry.schema.json
- glob: build/publisher-provided.schema.json
- glob: build/skill.schema.json
- glob: docs/server/swagger.yaml
- glob: docs/server/swagger.json
- glob: docs/operator/crd-api.md
# This section defines how and which artifacts we want to sign for the release.
signs:
- cmd: cosign
args:
- "sign-blob"
- "--bundle=${signature}" # cosign v3+: bundles signature and certificate together
- "${artifact}"
- "--yes" # needed on cosign 2.0.0+
artifacts: archive
output: true
signature: "${artifact}.sigstore.json"