release.yml

name: goreleaser

on:
  push:
    tags:
      - '*'

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
      -
        name: Set up Go
        uses: actions/setup-go@v2
        with:
          go-version: 1.17
      -
        name: Login to Public ECR
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: |
          aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
      -
        name: Login to Docker Registry
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | \
          docker login docker.pkg.github.com -u docker --password-stdin
      -
        name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v2
        with:
          version: latest
          args: -f build/.goreleaser.yml release --rm-dist
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      -
        name: Store Binaries
        uses: actions/upload-artifact@v2
        with:
          name: binaries
          path: dist/bin/
          retention-days: 5
  package:
    needs: goreleaser
    runs-on: macos-latest
    environment: Signing
    steps:
      -
        name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
      -
        name: Retrieve Binaries
        uses: actions/download-artifact@v2
        with:
          name: binaries
          path: dist/bin/
      -
        name: Import Signing Certificates
        uses: apple-actions/import-codesign-certs@v1
        with:
          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
          p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
      -
        name: Set version
        run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
      -
        name: Build, Sign, & Notarize Package
        env:
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
          VERSION: ${{ env.RELEASE_VERSION }}
        run: |
          ./build/build_package.sh
      -
        name: Store Package
        uses: actions/upload-artifact@v2
        with:
          name: package
          path: dist/macos/*.pkg
  upload:
    needs: package
    runs-on: ubuntu-latest
    steps:
      -
        name: Retrieve Package
        uses: actions/download-artifact@v2
        with:
          name: package
          path: dist/macos/
      -
        name: Upload package to release
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: dist/macos/*.pkg
          file_glob: true
          tag: ${{ github.ref }}
          overwrite: true