release.yml

---
# This workflow uses actions that are not certified by GitHub. They are provided
# by a third-party and are governed by separate terms of service, privacy
# policy, and support documentation.

name: Release
on:
  push:
    tags:
      - "*"
  workflow_dispatch:
    inputs:
      version:
        description: "Release version"
        required: false
        type: string

permissions: read-all

jobs:
  release_job:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    name: GoReleaser
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            api.gumroad.com:443
            github.com:443
            goreleaser.com:443
            objects.githubusercontent.com:443
            proxy.golang.org:443
            sum.golang.org:443
            uploads.github.com:443

      - name: Checkout Source
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: 0

      - name: Install Go
        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version: ">= 1.22.1"
          cache: true

      - name: Import GPG Signing Key
        uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
        id: import_gpg
        with:
          gpg_private_key: ${{ secrets.GPG_KEY_B64 }}
          passphrase: ${{ secrets.GPG_PWD }}

      - name: Checkout tag
        if: ${{ github.event.inputs.version != '' }}
        run: |
          git checkout refs/tags/${{ github.event.inputs.version }}

      - name: GoReleaser Action
        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
        with:
          distribution: goreleaser-pro
          version: latest
          args: release --clean