release.yml

name: Release Ratify

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions: read-all

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - name: Checkout
      uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # tag=3.0.2
      with:
          fetch-depth: 0
          
    - name: Set up Go
      uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
      with:
        go-version: 1.20

    - name: Goreleaser
      uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b # v4.2.0
      with:
        version: latest
        args: release --rm-dist
      env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Generate SBOM
      run: |
        curl -Lo $RUNNER_TEMP/sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64
        chmod +x $RUNNER_TEMP/sbom-tool
        $RUNNER_TEMP/sbom-tool generate -b . -bc . -pn ratify -pv $GITHUB_REF_NAME -ps Microsoft -nsb https://microsoft.com -V Verbose

    - name: Upload a Build Artifact
      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # tag=v3.1.2
      with:
        name: SBOM SPDX files
        path: _manifest/spdx_2.2/**