.goreleaser.yml

# Documentation: https://goreleaser.com/customization/
# yaml-language-server: $schema=https://goreleaser.com/static/schema-pro.json
version: 2
project_name: step

variables:
  packageName: step-cli
  packageRelease: 1 # Manually update release: in the nfpm section to match this value if you change this

before:
  hooks:
    - go mod download

after:
  hooks:
    # This script depends on IS_PRERELEASE env being set. This is set by CI in the Is Pre-release step.
    - cmd: bash scripts/package-repo-import.sh {{ .Var.packageName }} {{ .Version }}
      output: true

builds:
  - &BUILD
    id: default
    env:
      - CGO_ENABLED=0
    main: ./cmd/step/main.go
    flags:
      - -trimpath
    ldflags:
      - -w -X main.Version={{.Version}} -X main.BuildTime={{.Date}}
    gcflags:
      - >-
        {{- if ne (index .Env "DEBUG") "" }}all=-N -l{{- end }}
    targets:
      - darwin_amd64
      - darwin_arm64
      - freebsd_amd64
      - linux_386
      - linux_amd64
      - linux_arm64
      - linux_arm_5
      - linux_arm_6
      - linux_arm_7
      - linux_mips
      - linux_mips64
      - linux_ppc64le
      - windows_amd64
      - windows_arm64
    binary: bin/step
  -
    # This build is specifically for nFPM targets (.deb and .rpm files).
    # It's exactly the same as the default build above, except:
    # - it only builds the archs we want to produce .deb and .rpm files for
    # - the name of the output binary is step-cli
    << : *BUILD
    id: nfpm
    goos:
      - linux
    goarch:
      - amd64
      - arm64
    binary: step-cli

archives:
  - &ARCHIVE
    id: default
    # Can be used to change the archive formats for specific GOOSs.
    # Most common use case is to archive as zip on Windows.
    # Default is empty.
    name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Version }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"
    format_overrides:
      - goos: windows
        format: zip
    builds:
      - default
    wrap_in_directory: "{{ .ProjectName }}_{{ .Version }}"
    files:
      - README.md
      - LICENSE
      - autocomplete/*
  -
    << : *ARCHIVE
    id: unversioned
    name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"
    wrap_in_directory: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"


nfpms:
  # Configure nFPM for .deb and .rpm releases
  #
  # See https://nfpm.goreleaser.com/configuration/
  # and https://goreleaser.com/customization/nfpm/
  #
  # Useful tools for debugging .debs:
  # List file contents: dpkg -c dist/step_...deb
  # Package metadata: dpkg --info dist/step_....deb
  #
  - &NFPM
    id: packages
    builds:
      - nfpm
    package_name: "{{ .Var.packageName }}"
    release: "1"
    file_name_template: >-
      {{- trimsuffix .ConventionalFileName .ConventionalExtension -}}
      {{- if and (eq .Arm "6") (eq .ConventionalExtension ".deb") }}6{{ end -}}
      {{- if not (eq .Amd64 "v1")}}{{ .Amd64 }}{{ end -}}
      {{- .ConventionalExtension -}}
    vendor: Smallstep Labs
    homepage: https://github.com/smallstep/cli
    maintainer: Smallstep <techadmin@smallstep.com>
    description: >
      step-cli lets you build, operate, and automate Public Key Infrastructure (PKI) systems and workflows.

      It's a swiss army knife for authenticated encryption (X.509, TLS), single sign-on (OAuth OIDC, SAML), multi-factor authentication (OATH OTP, FIDO U2F), encryption mechanisms (JSON Web Encryption, NaCl), and verifiable claims (JWT, SAML assertions).
    license: Apache 2.0
    section: utils
    formats:
      - deb
      - rpm
    priority: optional
    bindir: /usr/bin
    contents:
      - src: debian/copyright
        dst: /usr/share/doc/step-cli/copyright
        # Ghost files are used for RPM and ignored elsewhere
      - dst: /usr/bin/step
        type: ghost
      - dst: /usr/share/bash-completion/completions/step
        type: ghost
    scripts:
      postinstall: scripts/postinstall.sh
      postremove: scripts/postremove.sh
    rpm:
      signature:
          key_file: "{{ .Env.GPG_PRIVATE_KEY_FILE }}"
    deb:
      signature:
          key_file: "{{ .Env.GPG_PRIVATE_KEY_FILE }}"
          type: origin
  -
    << : *NFPM
    id: unversioned
    file_name_template: "{{ .PackageName }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}{{ if .Mips }}_{{ .Mips }}{{ end }}"

source:
  enabled: true
  name_template: '{{ .ProjectName }}_{{ .Version }}'

checksum:
  name_template: 'checksums.txt'
  extra_files:
    - glob: ./.releases/*

signs:
- cmd: cosign
  signature: "${artifact}.sig"
  certificate: "${artifact}.pem"
  args: ["sign-blob", "--oidc-issuer=https://token.actions.githubusercontent.com", "--output-certificate=${certificate}", "--output-signature=${signature}", "${artifact}", "--yes"]
  artifacts: all

publishers:
- name: Google Cloud Artifact Registry
  ids:
  - packages
  cmd: ./scripts/package-upload.sh {{ abs .ArtifactPath }} {{ .Var.packageName }} {{ .Version }} {{ .Var.packageRelease }}

snapshot:
  name_template: "{{ .Tag }}-next"

release:
  # Repo in which the release will be created.
  # Default is extracted from the origin remote URL or empty if its private hosted.
  # Note: it can only be one: either github, gitlab or gitea
  github:
    owner: smallstep
    name: cli

  # IDs of the archives to use.
  # Defaults to all.
  #ids:
  #  - default
  #  - bar

  # If set to true, will not auto-publish the release.
  # Default is false.
  draft: false

  # If set to auto, will mark the release as not ready for production
  # in case there is an indicator for this in the tag e.g. v1.0.0-rc1
  # If set to true, will mark the release as not ready for production.
  # Default is false.
  prerelease: auto

  # You can change the name of the release.
  # Default is `{{.Tag}}`
  name_template: "Step CLI {{ .Tag }} ({{ .Env.RELEASE_DATE }})"

  # Header template for the release body.
  # Defaults to empty.
  header: |
    ## Official Release Artifacts

    Below are the most popular artifacts for `step` on each platform.

    For packaged versions (Homebrew, Scoop, etc.), see our [installation docs](https://smallstep.com/docs/step-cli/installation).

    #### Linux
    - 📦 [step_linux_{{ .Version }}_amd64.tar.gz](https://dl.smallstep.com/gh-release/cli/gh-release-header/{{ .Tag }}/step_linux_{{ .Version }}_amd64.tar.gz)
    - 📦 [step_linux_{{ .Version }}_arm64.tar.gz](https://dl.smallstep.com/gh-release/cli/gh-release-header/{{ .Tag }}/step_linux_{{ .Version }}_arm64.tar.gz)
    - 📦 [step_linux_{{ .Version }}_armv7.tar.gz](https://dl.smallstep.com/gh-release/cli/gh-release-header/{{ .Tag }}/step_linux_{{ .Version }}_armv7.tar.gz)
    - 📦 [step-cli_{{ replace .Version "-" "." }}-{{ .Var.packageRelease }}_amd64.deb](https://dl.smallstep.com/gh-release/cli/gh-release-header/{{ .Tag }}/step-cli_{{ replace .Version "-" "." }}-{{ .Var.packageRelease }}_amd64.deb)
    - 📦 [step-cli-{{ replace .Version "-" "." }}-{{ .Var.packageRelease }}.x86_64.rpm](https://dl.smallstep.com/gh-release/cli/gh-release-header/{{ .Tag }}/step-cli-{{ replace .Version "-" "." }}-{{ .Var.packageRelease }}.x86_64.rpm)
    - 📦 [step-cli_{{ replace .Version "-" "." }}-{{ .Var.packageRelease }}_arm64.deb](https://dl.smallstep.com/gh-release/cli/gh-release-header/{{ .Tag }}/step-cli_{{ replace .Version "-" "." }}-{{ .Var.packageRelease }}_arm64.deb)
    - 📦 [step-cli-{{ replace .Version "-" "." }}-{{ .Var.packageRelease }}.aarch64.rpm](https://dl.smallstep.com/gh-release/cli/gh-release-header/{{ .Tag }}/step-cli-{{ replace .Version "-" "." }}-{{ .Var.packageRelease }}.aarch64.rpm)
    - see `Assets` below for more builds

    #### macOS Darwin

    - 📦 [step_darwin_{{ .Version }}_amd64.tar.gz](https://dl.smallstep.com/gh-release/cli/gh-release-header/{{ .Tag }}/step_darwin_{{ .Version }}_amd64.tar.gz)
    - 📦 [step_darwin_{{ .Version }}_arm64.tar.gz](https://dl.smallstep.com/gh-release/cli/gh-release-header/{{ .Tag }}/step_darwin_{{ .Version }}_arm64.tar.gz)

    #### Windows

    - 📦 [step_windows_{{ .Version }}_amd64.zip](https://dl.smallstep.com/gh-release/cli/gh-release-header/{{ .Tag }}/step_windows_{{ .Version }}_amd64.zip)
    - 📦 [step_windows_{{ .Version }}_arm64.zip](https://dl.smallstep.com/gh-release/cli/gh-release-header/{{ .Tag }}/step_windows_{{ .Version }}_arm64.zip)


    ## Signatures and Checksums

    `step` uses [sigstore/cosign](https://github.com/sigstore/cosign) for signing and verifying release artifacts.

    Below is an example using `cosign` to verify a release artifact:

    ```
    cosign verify-blob \
      --certificate ~/Download/step_darwin_{{ .Version }}_amd64.tar.gz.pem \
      --signature ~/Downloads/step_darwin_{{ .Version }}_amd64.tar.gz.sig \
      --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
      --certificate-oidc-issuer https://token.actions.githubusercontent.com \
      ~/Downloads/step_darwin_{{ .Version }}_amd64.tar.gz
    ```

    The `checksums.txt` file (in the 'Assets' section below) contains a checksum for every artifact in the release.

  # Footer template for the release body.
  # Defaults to empty.
  footer: |
    ## Thanks!

    Those were the changes on {{ .Tag }}!

    Come join us on [Discord](https://discord.gg/X2RKGwEbV9) to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.

  # You can disable this pipe in order to not upload any artifacts.
  # Defaults to false.
  #disable: true

  # You can add extra preexisting files to the release.
  # The filename on the release will be the last part of the path (base). If
  # another file with the same name exists, the latest one found will be used.
  # Defaults to empty.
  extra_files:
    - glob: ./.releases/*
  #  - glob: ./glob/**/to/**/file/**/*
  #  - glob: ./glob/foo/to/bar/file/foobar/override_from_previous

blobs:
  - &S3_VERSIONED
    provider: s3
    disable: 'false'
    ids:
      - default
    bucket: '{{ .Env.AWS_S3_BUCKET }}'
    region: '{{ .Env.AWS_S3_REGION }}'
    directory: '/'
    acl: public-read
    extra_files:
      - glob: ./dist/default_darwin_amd64_v1/bin/step
        name_template: step_{{ .Version }}_darwin_amd64
      - glob: ./dist/default_darwin_arm64/bin/step
        name_template: step_{{ .Version }}_darwin_arm64
      - glob: ./dist/default_linux_amd64_v1/bin/step
        name_template: step_{{ .Version }}_linux_amd64
      - glob: ./dist/default_linux_arm64/bin/step
        name_template: step_{{ .Version }}_linux_arm64
      - glob: ./dist/default_windows_arm64/bin/step.exe
        name_template: step_{{ .Version }}_windows_amd64.exe
      - glob: ./dist/default_freebsd_*/bin/step
        name_template: step_{{ .Version }}_freebsd_amd64
    extra_files_only: true

  # Unversioned (`latest`) copies of binaries.
  # This section should only run on full releases (not prereleases).
  -
    << : *S3_VERSIONED
    disable: '{{ if .Prerelease }}true{{ else }}false{{ end }}'
    extra_files:
      - glob: ./dist/default_darwin_amd64_v1/bin/step
        name_template: step_latest_darwin_amd64
      - glob: ./dist/default_darwin_arm64/bin/step
        name_template: step_latest_darwin_arm64
      - glob: ./dist/default_linux_amd64_v1/bin/step
        name_template: step_latest_linux_amd64
      - glob: ./dist/default_linux_arm64/bin/step
        name_template: step_latest_linux_arm64
      - glob: ./dist/default_windows_arm64/bin/step.exe
        name_template: step_latest_windows_amd64.exe
      - glob: ./dist/default_freebsd_*/bin/step
        name_template: step_latest_freebsd_amd64
    extra_files_only: true

winget:
  -
    # IDs of the archives to use.
    # Empty means all IDs.
    ids: [ default ]

    #
    # Default: ProjectName
    # Templates: allowed
    name: step

    # Publisher name.
    #
    # Templates: allowed
    # Required.
    publisher: Smallstep

    # Your app's description.
    #
    # Templates: allowed
    # Required.
    short_description: "A Swiss army knife for working with X.509 certificates, JWTs, etc."

    # License name.
    #
    # Templates: allowed
    # Required.
    license: "Apache-2.0"

    # Publisher URL.
    #
    # Templates: allowed
    publisher_url: "https://smallstep.com"

    # Publisher support URL.
    #
    # Templates: allowed
    publisher_support_url: "https://github.com/smallstep/certificates/discussions"

    # URL which is determined by the given Token (github, gitlab or gitea).
    #
    # Default depends on the client.
    # Templates: allowed
    url_template: "https://github.com/smallstep/cli/releases/download/{{ .Tag }}/{{ .ArtifactName }}"

    # Git author used to commit to the repository.
    commit_author:
      name: goreleaserbot
      email: goreleaser@smallstep.com

    # The project name and current git tag are used in the format string.
    #
    # Templates: allowed
    commit_msg_template: "{{ .PackageIdentifier }}: {{ .Tag }}"

    # Your app's homepage.
    homepage: "https://github.com/smallstep/cli"

    # Your app's long description.
    #
    # Templates: allowed
    description: ""

    # License URL.
    #
    # Templates: allowed
    license_url: "https://github.com/smallstep/cli/blob/master/LICENSE"

    # Release notes URL.
    #
    # Templates: allowed
    release_notes_url: "https://github.com/smallstep/cli/releases/tag/{{ .Tag }}"

    # Create the PR - for testing
    skip_upload: auto

    # Tags.
    tags:
      - cli
      - smallstep

    # Repository to push the generated files to.
    repository:
      owner: smallstep
      name: winget-pkgs
      branch: "step-{{.Version}}"

      # Optionally a token can be provided, if it differs from the token
      # provided to GoReleaser
      # Templates: allowed
      #token: "{{ .Env.GITHUB_PERSONAL_AUTH_TOKEN }}"

      # Sets up pull request creation instead of just pushing to the given branch.
      # Make sure the 'branch' property is different from base before enabling
      # it.
      #
      # Since: v1.17
      pull_request:
        # Whether to enable it or not.
        enabled: true
        check_boxes: true
        # Whether to open the PR as a draft or not.
        #
        # Default: false
        # Since: v1.19
        # draft: true

        # Base can also be another repository, in which case the owner and name
        # above will be used as HEAD, allowing cross-repository pull requests.
        #
        # Since: v1.19
        base:
          owner: microsoft
          name: winget-pkgs
          branch: master

scoops:
  -
    ids: [ default ]
    name: step
    # Template for the url which is determined by the given Token (github or gitlab)
    # Default for github is "https://github.com/<repo_owner>/<repo_name>/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
    # Default for gitlab is "https://gitlab.com/<repo_owner>/<repo_name>/uploads/{{ .ArtifactUploadHash }}/{{ .ArtifactName }}"
    # Default for gitea is "https://gitea.com/<repo_owner>/<repo_name>/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
    url_template: "http://github.com/smallstep/cli/releases/download/{{ .Tag }}/{{ .ArtifactName }}"

    # Repository to push the app manifest to.
    repository:
      owner: smallstep
      name: scoop-bucket
      branch: main

    # Git author used to commit to the repository.
    # Defaults are shown.
    commit_author:
      name: goreleaserbot
      email: goreleaser@smallstep.com

    # The project name and current git tag are used in the format string.
    commit_msg_template: "Scoop update for {{ .ProjectName }} version {{ .Tag }}"

    # Your app's homepage.
    # Default is empty.
    homepage: "https://smallstep.com/"

    # Skip uploads for prerelease.
    skip_upload: auto

    # Your app's description.
    # Default is empty.
    description: "Crypto toolkit for working with X.509, OAuth, JWT, OATH OTP, etc."

    # Your app's license
    # Default is empty.
    license: "Apache-2.0"

  #dockers:
  #  - dockerfile: docker/Dockerfile
  #    goos: linux
  #    goarch: amd64
  #    use_buildx: true
  #    image_templates:
  #    - "smallstep/step-cli:latest"
  #    - "smallstep/step-cli:{{ .Tag }}"
  #    build_flag_templates:
  #    - "--platform=linux/amd64"
  #  - dockerfile: docker/Dockerfile
  #    goos: linux
  #    goarch: 386
  #    use_buildx: true
  #    image_templates:
  #    - "smallstep/step-cli:latest"
  #    - "smallstep/step-cli:{{ .Tag }}"
  #    build_flag_templates:
  #    - "--platform=linux/386"
  #  - dockerfile: docker/Dockerfile
  #    goos: linux
  #    goarch: arm
  #    goarm: 7
  #    use_buildx: true
  #    image_templates:
  #    - "smallstep/step-cli:latest"
  #    - "smallstep/step-cli:{{ .Tag }}"
  #    build_flag_templates:
  #    - "--platform=linux/arm/v7"
  #  - dockerfile: docker/Dockerfile
  #    goos: linux
  #    goarch: arm64
  #    use_buildx: true
  #    image_templates:
  #    - "smallstep/step-cli:latest"
  #    - "smallstep/step-cli:{{ .Tag }}"
  #    build_flag_templates:
  #    - "--platform=linux/arm64/v8"