# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
# goreleaser.yml
# Release automation
#
# Build customization
project_name: gopass
version: 2

before:
  hooks:
    - make clean
    - make completion
    - go mod download

builds:
  - id: gopass
    binary: gopass
    flags:
      - -trimpath
      - -tags=netgo
    env:
      - CGO_ENABLED=0
    asmflags:
      - all=-trimpath={{.Env.HOME}}
    gcflags:
      - all=-trimpath={{.Env.HOME}}
    ldflags: |
      -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -extldflags '-static'
    goos:
      - darwin
      - freebsd
      - linux
      - openbsd
      - windows
    goarch:
      - amd64
      - arm
      - arm64
    goarm:
      - 6
      - 7
    ignore:
      - goos: windows
        goarch: arm
    mod_timestamp: '{{ .CommitTimestamp }}'
archives:
  - id: gopass
    name_template: "{{.Binary}}-{{.Version}}-{{.Os}}-{{.Arch}}{{ if .Arm }}v{{.Arm }}{{ end }}"
    formats: ['tar.gz']
    format_overrides:
      - goos: windows
        formats: ['zip']
    files:
      - CHANGELOG.md
      - LICENSE
      - README.md
      - bash.completion
      - fish.completion
      - zsh.completion

release:
  github:
    owner: gopasspw
    name: gopass
  draft: false
  prerelease: auto

nfpms:
  - id: gopass_deb
    vendor: Gopass Authors
    homepage: "https://www.gopass.pw"
    maintainer: "Gopass Authors <gopass@gopass.pw>"
    description: |-
      gopass password manager - full featured CLI replacement for pass, designed for teams.
       .
      gopass is a simple but powerful password manager for your terminal. It is a
      Pass implementation in Go that can be used as a drop in replacement.
       .
      Every secret lives inside of a gpg (or: age) encrypted textfile. These secrets
      can be organized into meaninful hierachies and are by default versioned using
      git.
       .
      This package contains the main gopass binary from gopass.pw. In Debian and
      Ubuntu there is an unfortunate name clash with another gopass package. That is
      completely different and not related to this package.
    license: MIT
    formats:
      - deb
    dependencies:
      - git
      - gnupg
    recommends:
      - rng-tools
      - bash-completion
    contents:
      - src: gopass.1
        dst: /usr/share/man/man1/gopass.1
      - src: LICENSE
        dst: /usr/share/doc/gopass/LICENSE
      - src: CHANGELOG.md
        dst: /usr/share/doc/gopass/CHANGELOG.md
      - src: bash.completion
        dst: /usr/share/bash-completion/completions/gopass
      - src: fish.completion
        dst: /usr/share/fish/vendor_completions.d/gopass.fish
      - src: zsh.completion
        dst: /usr/share/zsh/functions/Completion/Linux/_gopass
  - id: gopass_rpm
    vendor: Gopass Authors
    homepage: "https://www.gopass.pw"
    maintainer: "Gopass Authors <gopass@gopass.pw>"
    description: |-
      gopass password manager - full featured CLI replacement for pass, designed for teams.

      gopass is a simple but powerful password manager for your terminal. It is a
      Pass implementation in Go that can be used as a drop in replacement.

      Every secret lives inside of a gpg (or: age) encrypted textfile. These secrets
      can be organized into meaninful hierachies and are by default versioned using
      git.
    license: MIT
    formats:
      - rpm
    dependencies:
      - git
      - gnupg2
    recommends:
      - rng-tools
      - bash-completion
    contents:
      - src: gopass.1
        dst: /usr/share/man/man1/gopass.1
      - src: LICENSE
        dst: /usr/share/doc/gopass/LICENSE
      - src: CHANGELOG.md
        dst: /usr/share/doc/gopass/CHANGELOG.md
      - src: bash.completion
        dst: /usr/share/bash-completion/completions/gopass
      - src: fish.completion
        dst: /usr/share/fish/vendor_completions.d/gopass.fish
      - src: zsh.completion
        dst: /usr/share/zsh/functions/Completion/Linux/_gopass

source:
  enabled: true
  name_template: "{{.ProjectName}}-{{.Version}}"
  
checksum:
  name_template: "{{.ProjectName}}_{{.Version}}_SHA256SUMS"

milestones:
  -
    repo:
      owner: gopasspw
      name: gopass
    close: true
    fail_on_error: false
    name_template: "{{ .Major }}.{{ .Minor }}.{{ .Patch }}"

signs:
  -
    id: gopass-gpg
    cmd: sh
    artifacts: checksum
    env:
      - "ARTIFACT=${artifact}"
      - "SIGNATURE=${signature}"
    args:
      - -ec
      - |
        if [ -n "${GPG_FINGERPRINT:-}" ]; then
          exec gpg --batch -u "${GPG_FINGERPRINT}" --armor --output "${SIGNATURE}" --detach-sign "${ARTIFACT}"
        fi

        echo "skipping GPG signing; set GPG_FINGERPRINT to sign locally" >&2
  -
    id: gopass-cosign
    cmd: sh
    artifacts: checksum
    signature: "${artifact}.sigstore.json"
    env:
      - "ARTIFACT=${artifact}"
      - "SIGNATURE=${signature}"
    args:
      - -ec
      - |
        if [ "${GITHUB_ACTIONS}" = "true" ]; then
          exec cosign sign-blob --bundle="${SIGNATURE}" "${ARTIFACT}" --yes
        fi

        if [ -n "${COSIGN_KEY:-}" ]; then
          exec cosign sign-blob --key "${COSIGN_KEY}" --bundle="${SIGNATURE}" "${ARTIFACT}" --yes
        fi

        echo "skipping cosign signing outside GitHub Actions; set COSIGN_KEY to sign locally" >&2

# creates SBOMs of all archives and the source tarball using syft
# https://goreleaser.com/customization/sbom
sboms:
  - artifacts: archive
  - id: source # Two different sbom configurations need two different IDs
    artifacts: source