release.yaml

# ------------------------------------------------------------------------
# SPDX-FileCopyrightText: Copyright © 2024 The Protobom Authors
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: Apache-2.0
# ------------------------------------------------------------------------
---
name: Release

on:
  push:
    tags: v*

permissions:
  contents: read

jobs:
  release:
    runs-on: ubuntu-latest

    permissions:
      contents: write # needed to write releases

    steps:
      - name: Set tag name
        shell: bash
        run: echo "TAG=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV

      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1

      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version-file: go.mod
          cache: false
          check-latest: true

      - name: Install bom
        uses: kubernetes-sigs/release-actions/setup-bom@a69972745f85aab4ba5d6c681e2a0e7f73eaff2b # v0.3.0

      - name: Generate SBOM
        shell: bash
        run: bom generate --format=json -o /tmp/protobom-storage-$TAG.spdx.json .

      - name: Publish Release
        uses: kubernetes-sigs/release-actions/publish-release@a69972745f85aab4ba5d6c681e2a0e7f73eaff2b # v0.3.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          assets: /tmp/protobom-storage-$TAG.spdx.json
          sbom: false