release-stable.yaml

name: release/stable

on:
  push:
    tags: ["v[0-9]+.[0-9]+.[0-9]+"]

permissions:
  contents: write
  packages: write

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    container: kraftkit.sh/myself-full:latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Fetch all tags
        run: |
          git config --global --add safe.directory /__w/kraftkit/kraftkit
          git fetch --force --tags

      - name: Install release tools
        run: |
          echo "deb [trusted=yes] https://apt.fury.io/cli/ * *" > /etc/apt/sources.list.d/fury-cli.list
          apt-get update
          apt-get install -y --no-install-recommends \
            fury-cli

      - name: Generate GoReleaser configuration
        run: |
          ytt -f .goreleaser-stable.yaml > goreleaser-stable.yaml

      - name: Write cosign key to file
        run: |
          echo "$COSIGN_KEY" > cosign.key
          chmod 600 cosign.key
        env:
          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}

      - name: Run GoReleaser
        run: |
          GORELEASER_PREVIOUS_TAG=$(curl -s "https://get.kraftkit.sh/latest.txt")
          export GORELEASER_PREVIOUS_TAG="v$GORELEASER_PREVIOUS_TAG"
          export GORELEASER_CURRENT_TAG="${{  github.ref_name }}"
          echo "$GOOGLE_APPLICATION_JSON" > /tmp/gs.json
          goreleaser release \
            --config goreleaser-stable.yaml \
            --clean \
            --skip-validate
          fury push "$(ls ./dist/kraftkit_*_linux_amd64.deb)" --quiet --account "$FURY_USER" --api-token "$FURY_TOKEN"
          fury push "$(ls ./dist/kraftkit_*_linux_arm64.deb)" --quiet --account "$FURY_USER" --api-token "$FURY_TOKEN"
          fury push "$(ls ./dist/kraftkit_*_linux_amd64.rpm)" --quiet --account "$FURY_USER" --api-token "$FURY_TOKEN"
          fury push "$(ls ./dist/kraftkit_*_linux_arm64.rpm)" --quiet --account "$FURY_USER" --api-token "$FURY_TOKEN"
          # Enable this back when the archive format is no longer malformed
          # fury push "$(ls ./dist/kraftkit_*_linux_amd64.apk)" --quiet --account "$FURY_USER" --api-token "$FURY_TOKEN"
          # fury push "$(ls ./dist/kraftkit_*_linux_arm64.apk)" --quiet --account "$FURY_USER" --api-token "$FURY_TOKEN"
        env:
          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
          FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
          FURY_USER: ${{ secrets.FURY_USER }}
          AUR_KEY: ${{ secrets.AUR_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}