build.yaml

name: Build

on:
  workflow_call:
    inputs:
      snapshot:
        description: "Whether to run in snapshot mode"
        required: false
        type: boolean
        default: false

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: write
      attestations: write
      id-token: write
    env:
      CGO_ENABLED: 0
      TAG: ${{ github.ref_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@c4c114188661c0fa735e5b938764519fc6e8efa9
        with:
          go-version: 1.24.1

      - name: Login to Docker Hub
        uses: docker/login-action@327cd5a69de6c009b9ce71bce8395f28e651bf99
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GHCR
        uses: docker/login-action@327cd5a69de6c009b9ce71bce8395f28e651bf99
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3
        with:
          distribution: goreleaser
          version: v2.7.0
          args: release --clean ${{ inputs.snapshot && '--snapshot' || '' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2
        if: success()
        with:
          subject-path: "dist/**/*"