Felipe M.
9e888709d1
Generate a detached GPG signature alongside each .tar.gz so users can verify the bundle came from this repository. The signing key and passphrase are pulled from repo secrets.
49 lines
1.2 KiB
YAML
49 lines
1.2 KiB
YAML
name: release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: docker
|
|
container: git.nakama.town/fmartingr/ci-images/ci-base:1.0.0
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
|
|
- uses: actions/setup-bun@v2
|
|
with:
|
|
bun-version: latest
|
|
|
|
- name: Build plugin
|
|
run: make dist
|
|
|
|
- name: Sign plugin bundle
|
|
env:
|
|
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
|
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
|
|
run: |
|
|
echo "$GPG_PRIVATE_KEY" | gpg --batch --import
|
|
for bundle in dist/*.tar.gz; do
|
|
gpg --batch --yes --pinentry-mode loopback \
|
|
--passphrase "$GPG_PASSPHRASE" \
|
|
--detach-sign --armor \
|
|
--output "${bundle}.sig" \
|
|
"$bundle"
|
|
done
|
|
|
|
- uses: actions/forgejo-release@v2.11.1
|
|
with:
|
|
direction: upload
|
|
token: ${{ secrets.FORGEJO_TOKEN }}
|
|
tag: ${{ github.ref_name }}
|
|
release-dir: dist/
|
|
release-dir-include-pattern: '*.tar.gz*'
|
|
prerelease: ${{ contains(github.ref_name, '-rc') }}
|