fix: publish and notarise binaries.

.github/workflows/release.yml

@@ -12,7 +12,38 @@ permissions:
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release-please.outputs.release_created }}
     steps:
       - uses: googleapis/release-please-action@v4
+        id: release-please
         with:
           token: ${{secrets.GITHUB_TOKEN}}
+
+  goreleaser:
+    runs-on: ubuntu-latest
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          # 'latest', 'nightly', or a semver
+          version: '~> v2'
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12}}
+          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD}}
+          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID}}
+          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID}}
+          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY}}

.goreleaser.yaml

@@ -23,7 +23,7 @@ builds:
         goarch: '386'
     # Custom ldflags.
     ldflags:
-      - -s -w -X main.AppVersion={{.Version}} -X main.AppCommit={{.Commit}} -X main.AppCommitDate={{.CommitDate}}
+      - '-s -w -X main.AppVersion={{.Version}} -X main.AppCommit={{.ShortCommit}} -X main.AppCommitDate={{.CommitDate}}'
     # Path to main.go file or main package.
     # Default: `.`.
     main: ./cmd/argon2
@@ -57,3 +57,35 @@ release:
     ---
 
     Released by [GoReleaser](https://github.com/goreleaser/goreleaser).
+
+notarize:
+  macos:
+    - # Whether this configuration is enabled or not.
+      enabled: true
+
+      # Before notarizing, we need to sign the binary.
+      # This block defines the configuration for doing so.
+      sign:
+        # The .p12 certificate file path or its base64'd contents.
+        certificate: "{{.Env.MACOS_SIGN_P12}}"
+
+        # The password to be used to open the certificate.
+        password: "{{.Env.MACOS_SIGN_PASSWORD}}"
+
+      # Then, we notarize the binaries.
+      notarize:
+        # The issuer ID.
+        # Its the UUID you see when creating the App Store Connect key.
+        issuer_id: "{{.Env.MACOS_NOTARY_ISSUER_ID}}"
+
+        # Key ID.
+        # You can see it in the list of App Store Connect Keys.
+        # It will also be in the ApiKey filename.
+        key_id: "{{.Env.MACOS_NOTARY_KEY_ID}}"
+
+        # The .p8 key file path or its base64'd contents.
+        key: "{{.Env.MACOS_NOTARY_KEY}}"
+
+        # Whether to wait for the notarization to finish.
+        # Not recommended, as it could take a really long time.
+        wait: false

cmd/argon2/main.go

@@ -10,7 +10,7 @@ import (
 	"github.com/matthewhartstonge/argon2"
 )
 
-const (
+var (
 	// AppName configures the binaries name.
 	AppName = "argon2"
 	// AppVersion outputs the binaries version.

release-please-config.json

@@ -7,7 +7,10 @@
       "bump-minor-pre-major": false,
       "bump-patch-for-minor-pre-major": false,
       "draft": false,
-      "prerelease": false
+      "prerelease": false,
+      "extra-files": [
+        "cmd/argon2/main.go"
+      ]
     }
   },
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json"