publish.terraform-provider-secretsmanager.yml

# This GitHub action can publish assets for release when a tag is created.
# Currently, its setup to run on any tag that matches the pattern "v*" (ie. v0.1.0).
#
name: release
on:
  push:
    tags:
      - 'v*'
jobs:
  goreleaser:
    environment: prod
    runs-on: ubuntu-latest
    steps:
      - name: Retrieve secrets from Keeper
        id: ksecrets
        uses: Keeper-Security/ksm-action@master
        with:
          keeper-secret-config: ${{ secrets.KSM_PUBLISHER_CONFIG }}
          secrets: |
            sZ5fnzalziVolGvaVo8oKw/custom_field/PGP_PRIVATE_KEY_BLOCK_-_ASCII-armor_format > GPG_PRIVATE_KEY
            sZ5fnzalziVolGvaVo8oKw/custom_field/Pass_Phrase > GPG_PASSPHRASE

      - name: Checkout
        uses: actions/checkout@v2.3.4

      - name: Unshallow
        run: git fetch --prune --unshallow

      - name: Set up Go
        uses: actions/setup-go@v2
        with:
          go-version: 1.18

      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ steps.ksecrets.outputs.GPG_PRIVATE_KEY }}
          passphrase: ${{ steps.ksecrets.outputs.GPG_PASSPHRASE }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: '~> v2'
          args: release --clean
        env:
          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
          # GitHub sets this automatically
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}