cryptodeps/.goreleaser.yml at main · csnp/cryptodeps · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
# GoReleaser configuration for CryptoDeps
# https://goreleaser.com

version: 2

project_name: cryptodeps

before:
  hooks:
    - go mod tidy

builds:
  - id: cryptodeps
    main: ./cmd/cryptodeps
    binary: cryptodeps
    env:
      - CGO_ENABLED=0
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
    # ARM v7 for Raspberry Pi
    goarm:
      - "7"
    ignore:
      - goos: windows
        goarch: arm64
    ldflags:
      - -s -w
      - -X main.version={{.Version}}
      - -X main.commit={{.Commit}}
      - -X main.date={{.Date}}
    flags:
      - -trimpath

archives:
  - id: default
    format: tar.gz
    name_template: >-
      {{ .ProjectName }}_
      {{- .Version }}_
      {{- .Os }}_
      {{- if eq .Arch "amd64" }}x86_64
      {{- else if eq .Arch "386" }}i386
      {{- else }}{{ .Arch }}{{ end }}
      {{- if .Arm }}v{{ .Arm }}{{ end }}
    format_overrides:
      - goos: windows
        format: zip
    files:
      - README.md
      - LICENSE
      - CHANGELOG.md*

checksum:
  name_template: 'checksums.txt'
  algorithm: sha256

snapshot:
  # Use commit-based versioning to handle non-semver tags (like db-*)
  version_template: "snapshot-{{ .ShortCommit }}"

changelog:
  sort: asc
  use: github
  filters:
    exclude:
      - '^docs:'
      - '^test:'
      - '^ci:'
      - '^chore:'
      - Merge pull request
      - Merge branch
  groups:
    - title: 'New Features'
      regexp: '^feat:'
      order: 0
    - title: 'Bug Fixes'
      regexp: '^fix:'
      order: 1
    - title: 'Security'
      regexp: '^security:'
      order: 2
    - title: 'Other'
      order: 999

# TODO: Add Homebrew tap in future release
# brews:
#   - name: cryptodeps
#     repository:
#       owner: csnp
#       name: homebrew-tap
#       token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
#     directory: Formula
#     homepage: "https://github.com/csnp/qramm-cryptodeps"
#     description: "Analyze dependencies for quantum-vulnerable cryptographic algorithms"
#     license: "Apache-2.0"
#     skip_upload: auto
#     test: |
#       system "#{bin}/cryptodeps", "version"
#     install: |
#       bin.install "cryptodeps"

# Docker images
dockers:
  - image_templates:
      - "ghcr.io/csnp/qramm-cryptodeps:{{ .Tag }}"
      - "ghcr.io/csnp/qramm-cryptodeps:v{{ .Major }}"
      - "ghcr.io/csnp/qramm-cryptodeps:v{{ .Major }}.{{ .Minor }}"
      - "ghcr.io/csnp/qramm-cryptodeps:latest"
    dockerfile: build/Dockerfile
    build_flag_templates:
      - "--pull"
      - "--label=org.opencontainers.image.created={{.Date}}"
      - "--label=org.opencontainers.image.title={{.ProjectName}}"
      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
      - "--label=org.opencontainers.image.version={{.Version}}"
      - "--label=org.opencontainers.image.source=https://github.com/csnp/qramm-cryptodeps"
      - "--platform=linux/amd64"
    skip_push: auto

# GitHub release
release:
  github:
    owner: csnp
    name: qramm-cryptodeps
  draft: false
  prerelease: auto
  mode: replace
  header: |
    ## CryptoDeps {{ .Tag }}

    Analyze your dependencies for quantum-vulnerable cryptographic algorithms.

    ### Installation

    **Linux/macOS (Binary):**
    ```bash
    curl -sSL https://github.com/csnp/qramm-cryptodeps/releases/download/{{ .Tag }}/cryptodeps_{{ .Version }}_$(uname -s)_$(uname -m).tar.gz | tar xz
    sudo mv cryptodeps /usr/local/bin/
    ```

    **Go Install:**
    ```bash
    go install github.com/csnp/qramm-cryptodeps/cmd/cryptodeps@{{ .Tag }}
    ```

    **Docker:**
    ```bash
    docker run --rm -v $(pwd):/workspace ghcr.io/csnp/qramm-cryptodeps:{{ .Tag }} analyze /workspace
    ```

  footer: |
    ---

    **Full Changelog**: https://github.com/csnp/qramm-cryptodeps/compare/{{ .PreviousTag }}...{{ .Tag }}

    Part of the [QRAMM Toolkit](https://qramm.org) by [CSNP](https://csnp.org).

  extra_files:
    - glob: ./data/crypto-database.json

# TODO: Enable cosign signing once properly configured
# Sign releases with cosign
# signs:
#   - cmd: cosign
#     env:
#       - COSIGN_EXPERIMENTAL=1
#     certificate: '${artifact}.pem'
#     args:
#       - sign-blob
#       - '--output-certificate=${certificate}'
#       - '--output-signature=${signature}'
#       - '${artifact}'
#       - '--yes'
#     artifacts: checksum
#     output: true