Include encoded resume info instead of clobbering it (#5110) #1367
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - v* | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| jobs: | |
| Release: | |
| runs-on: ubuntu-latest | |
| env: | |
| DOCKER_CLI_EXPERIMENTAL: "enabled" | |
| steps: | |
| # Setup steps - no external side effects. | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4 | |
| - name: Docker Login to DockerHub | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Docker Login to GitHub Container Registry | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version: "1.25" | |
| - name: Cosign install | |
| uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2 | |
| - name: Install UPX | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y upx | |
| # GoReleaser pipeline (sequential, not atomic): | |
| # 1. build + archive + checksum + sign (local only, no side effects) | |
| # 2. homebrew tap update (commit to trufflesecurity/homebrew-trufflehog) | |
| # 3. docker images + manifests (DockerHub + GHCR, including :latest tags) | |
| # 4. github release creation (artifacts uploaded, make_latest: false) | |
| # | |
| # On failure: GoReleaser does not roll back completed phases. Depending | |
| # on where it failed, some subset of the above may have been published. | |
| # Check: | |
| # - Homebrew tap: https://github.com/trufflesecurity/homebrew-trufflehog | |
| # - DockerHub: https://hub.docker.com/r/trufflesecurity/trufflehog/tags | |
| # - GHCR: https://github.com/trufflesecurity/trufflehog/pkgs/container/trufflehog | |
| # - GH releases: https://github.com/trufflesecurity/trufflehog/releases | |
| # | |
| # If the GitHub release was created but artifacts are missing, the | |
| # install script (scripts/install.sh) will fail for users on that | |
| # version. The release is NOT marked latest (make_latest: false), so | |
| # /releases/latest still points to the previous good release. | |
| - name: Run GoReleaser | |
| uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7 | |
| with: | |
| distribution: goreleaser-pro | |
| version: latest | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} | |
| GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} | |
| # Promotes the GitHub release to "latest" only after the Release job fully | |
| # succeeds (including post-steps). At this point, all artifacts have been | |
| # published: Docker images and :latest tags are live, the Homebrew tap is | |
| # updated, binaries are attached to the GitHub release, and checksums are | |
| # signed. | |
| # | |
| # If this job fails, the release exists with all artifacts but is not flagged | |
| # as latest. /releases/latest and scripts/install.sh still point to the | |
| # previous release. To manually promote: | |
| # gh release edit <tag> --latest --repo trufflesecurity/trufflehog | |
| mark-latest: | |
| needs: Release | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Mark release as latest | |
| run: gh release edit "$TAG" --latest | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_REPO: ${{ github.repository }} | |
| TAG: ${{ github.ref_name }} |