fix: allows for diff kms keys to be used for root/intermediate in cert-utility

.github/workflows/build.yml

@@ -6,6 +6,10 @@ on:
     branches: [main]
   push:
     branches: [main]
+    paths-ignore:
+      - README.md
+      - catalog-info.yaml
+      - renovate.json
 
 jobs:
   lint:
@@ -21,17 +25,41 @@ jobs:
         with:
           version: v1.62.0
           args: --timeout=5m
-          skip-pkg-cache: true
-          skip-build-cache: true
+          only-new-issues: true
       - name: Run linter
         run: golangci-lint run
   test:
     name: test
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        go-version: ['1.21', '1.22', '1.23']
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
         with:
-          go-version: '1.23'
+          go-version: ${{ matrix.go-version }}
       - name: Run tests
         run: make test
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    needs: [test]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        with:
+          go-version: '1.23'
+          cache: true
+      - name: Build
+        run: |
+          VERSION=${{ github.ref_name }}
+          if [[ "${{ github.ref_type }}" == "branch" ]]; then
+            VERSION="${VERSION}-${GITHUB_SHA::8}"
+          fi
+          go build -ldflags "-X main.version=${VERSION}" -o bin/sigstore-certificate-maker ./...
+      - name: Upload binary
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        with:
+          name: sigstore-certificate-maker
+          path: bin/sigstore-certificate-maker

.github/workflows/release.yml

@@ -5,6 +5,7 @@ on:
   push:
     tags:
       - v*
+    branches: main
 
 jobs:
   release:
@@ -14,14 +15,33 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          fetch-depth: 0
       - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5
         with:
-          go-version: '1.22'
-      - name: Build and release
+          go-version: '1.23'
+          cache: true
+
+      - name: Run go-semantic-release
+        uses: go-semantic-release/action@48d83acd958dae62e73701aad20a5b5844a3bf45 # v1.23.0
+        id: semrel
+        with:
+          github-token: ${{ github.token }}
+          changelog-generator-opt: emojis=true
+          allow-initial-development-versions: true
+
+      - name: Build and package
+        if: steps.semrel.outputs.version != ''
         run: |
-          go build -o sigstore-certificate-maker
+          echo "Creating release version v${steps.semrel.outputs.version}"
+          go test -v .
+          go build -ldflags "-X main.version=v${steps.semrel.outputs.version}" -o sigstore-certificate-maker
           tar czf sigstore-certificate-maker.tar.gz sigstore-certificate-maker
+
       - name: Create Release
+        if: steps.semrel.outputs.version != ''
         uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8 # v2
         with:
           files: sigstore-certificate-maker.tar.gz
+          tag_name: v${{ steps.semrel.outputs.version }}
+          generate_release_notes: true

.gitignore

@@ -27,3 +27,6 @@ build/
 
 # Brew
 Brewfile.lock.json
+
+# macOS
+.DS_Store

.golangci.yaml

@@ -1,7 +1,7 @@
 ---
 run:
   timeout: 5m
-  go: "1.22"
+  go: "1.23"
 
 linters-settings:
   errcheck: