.goreleaser.yaml

# goreleaser configuration for pg_hardstorage.
#
# Builds two binaries (pg_hardstorage + pg_hardstorage_testkit) for
# linux/{amd64,arm64} and darwin/arm64. Windows isn't on the roadmap
# (the agent assumes systemd / FHS); we publish a windows/amd64 of the
# CLI only so dev workstations on Windows can still talk to a remote
# control plane.
#
# Reproducibility:
#   - -trimpath strips local paths
#   - -buildvcs=false drops the git revision from the runtime info
#   - LDFLAGS pin Version/Commit/Date — the Makefile uses the same
#     vars so `make build` and goreleaser produce equivalent binaries
#
# Signing: cosign keyless (Sigstore + GitHub Actions OIDC) signs every
# tarball, .deb, .rpm, and container image. The signatures land
# alongside the artefacts on the GitHub Release.

version: 2

project_name: pg_hardstorage

before:
  hooks:
    - go mod tidy

builds:
  - id: pg_hardstorage
    binary: pg_hardstorage
    main: ./cmd/pg_hardstorage
    env:
      - CGO_ENABLED=0
    flags:
      - -trimpath
      - -buildvcs=false
    ldflags:
      - -s -w
      - -X github.com/cybertec-postgresql/pg_hardstorage/internal/version.Version={{.Version}}
      - -X github.com/cybertec-postgresql/pg_hardstorage/internal/version.Commit={{.ShortCommit}}
      - -X github.com/cybertec-postgresql/pg_hardstorage/internal/version.Date={{.Date}}
    goos: [linux, darwin, windows]
    goarch: [amd64, arm64]
    ignore:
      # darwin/amd64 is dropping off our support matrix; arm64-only
      # for macOS reduces the artefact count without leaving anyone
      # important behind.
      - goos: darwin
        goarch: amd64
      # windows/arm64 is rare enough we don't ship it.
      - goos: windows
        goarch: arm64

  - id: pg_hardstorage_testkit
    binary: pg_hardstorage_testkit
    main: ./cmd/pg_hardstorage_testkit
    env:
      - CGO_ENABLED=0
    flags:
      - -trimpath
      - -buildvcs=false
    ldflags:
      - -s -w
      - -X github.com/cybertec-postgresql/pg_hardstorage/internal/version.Version={{.Version}}
      - -X github.com/cybertec-postgresql/pg_hardstorage/internal/version.Commit={{.ShortCommit}}
      - -X github.com/cybertec-postgresql/pg_hardstorage/internal/version.Date={{.Date}}
    goos: [linux, darwin]
    goarch: [amd64, arm64]
    ignore:
      - goos: darwin
        goarch: amd64

archives:
  - id: pg_hardstorage
    ids: [pg_hardstorage]
    name_template: >-
      {{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}
    formats: [tar.gz]
    format_overrides:
      - goos: windows
        formats: [zip]
    files:
      - LICENSE
      - README.md
      - CHANGELOG.md
      - docs/**/*

  - id: pg_hardstorage_testkit
    ids: [pg_hardstorage_testkit]
    name_template: >-
      pg_hardstorage_testkit_{{ .Version }}_{{ .Os }}_{{ .Arch }}
    formats: [tar.gz]
    files:
      - LICENSE
      - README.md

# Homebrew cask — publishes Casks/pg_hardstorage.rb to the org-wide tap
# on each release, so `brew install cybertec-postgresql/tap/pg_hardstorage`
# works on macOS (Apple Silicon) and Linux (amd64/arm64).  goreleaser
# generates the cask from the pg_hardstorage archive and commits it.
#
# Why a cask and not a formula: goreleaser deprecated the `brews:`
# (formula) pipe in v2.16 in favour of `homebrew_casks:` — formulas were
# a hack for shipping pre-compiled binaries; casks are the supported way
# now.  The install command for end users is unchanged.
#
# Auth: the default GITHUB_TOKEN can only write the current repo, so the
# push to the separate tap repo uses HOMEBREW_TAP_TOKEN (a fine-grained
# PAT scoped to contents:write on homebrew-tap), passed through in
# .github/workflows/release.yml.
homebrew_casks:
  - name: pg_hardstorage
    # Only the pg_hardstorage CLI archive — without this filter goreleaser
    # would also pull in the pg_hardstorage_testkit archive (two archives
    # per OS/arch), producing an ambiguous cask. Mirrors nfpms.ids.
    ids: [pg_hardstorage]
    binaries:
      - pg_hardstorage
    repository:
      owner: cybertec-postgresql
      name: homebrew-tap
      token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
    # Commit author for the cask bump in the tap repo.
    commit_author:
      name: cybertec-postgresql
      email: office@cybertec.at
    commit_msg_template: "pg_hardstorage: update cask to {{ .Tag }}"
    homepage: "https://github.com/cybertec-postgresql/pg_hardstorage"
    description: >-
      PostgreSQL backup, done right — agent + CLI with continuous WAL
      streaming, content-addressed dedup, envelope encryption, and
      signed manifests.
    # No hard PostgreSQL dependency: the agent talks to PostgreSQL over
    # the replication protocol (often a *remote* DB), so forcing a local
    # server build on every install is wrong.  Surface the optional
    # client as a caveat instead.
    caveats: |
      pg_hardstorage connects to PostgreSQL over the replication protocol
      and needs no local PostgreSQL server. If you want the psql client
      locally, install it separately:
        brew install libpq           # client only
        brew install postgresql@18   # full server

      Docs: https://docs.pghardstorage.org
    hooks:
      post:
        # The release binaries are cosign-signed but NOT Apple-notarised,
        # so on macOS Gatekeeper would quarantine the binary and refuse to
        # run it ("pg_hardstorage is damaged and cannot be opened").  Strip
        # the quarantine xattr on install.  Guarded by OS.mac? so the Linux
        # cask path is unaffected.
        install: |
          if OS.mac?
            system_command "/usr/bin/xattr",
                           args: ["-dr", "com.apple.quarantine", "#{staged_path}/pg_hardstorage"]
          end

checksum:
  name_template: "checksums.txt"
  algorithm: sha256

source:
  enabled: true
  name_template: "{{ .ProjectName }}-{{ .Version }}-source"
  format: tar.gz

sboms:
  - artifacts: archive
    documents:
      - "${artifact}.spdx.sbom.json"

signs:
  # Keyless cosign signing of every release artefact + checksums file.
  # The .pem and .sig land on the GitHub Release alongside the artefact.
  - id: cosign-keyless
    cmd: cosign
    certificate: "${artifact}.pem"
    args:
      - sign-blob
      - "--yes"
      - "--output-certificate=${certificate}"
      - "--output-signature=${signature}"
      - "${artifact}"
    artifacts: all
    output: true

snapshot:
  version_template: "{{ .Tag }}-SNAPSHOT-{{ .ShortCommit }}"

changelog:
  use: github
  sort: asc
  filters:
    exclude:
      - "^docs:"
      - "^test:"
      - "^chore:"
      - "Merge pull request"
      - "Merge branch"

# Linux distro packages — we ship .deb and .rpm so admins on
# managed-server fleets don't have to wrap the tarball in their own
# packaging. Both consume the systemd units in deploy/systemd/ via
# overrides_include hooks (added when we wire native debian/ + .spec).
nfpms:
  - id: pg_hardstorage-deb-rpm
    package_name: pg-hardstorage
    file_name_template: "{{ .ConventionalFileName }}"
    ids: [pg_hardstorage]
    vendor: "CYBERTEC PostgreSQL International GmbH"
    homepage: https://github.com/cybertec-postgresql/pg_hardstorage
    maintainer: "Hans-Jürgen Schönig <hs@cybertec.at>"
    description: |
      pg_hardstorage — PostgreSQL backup, done right.
      WAL streaming over the replication protocol; content-addressed
      chunked dedup; cosign-signed manifests; built-in retention,
      verification, scheduling.
    license: Apache-2.0
    section: database
    priority: optional
    formats: [deb, rpm]
    bindir: /usr/bin
    contents:
      - src: deploy/systemd/pg_hardstorage.service
        dst: /usr/lib/systemd/system/pg_hardstorage.service
      - src: deploy/systemd/pg_hardstorage@.service
        dst: /usr/lib/systemd/system/pg_hardstorage@.service
      - src: deploy/systemd/pg-hardstorage.sysusers.conf
        dst: /usr/lib/sysusers.d/pg-hardstorage.conf
      - src: deploy/systemd/pg-hardstorage.tmpfiles.conf
        dst: /usr/lib/tmpfiles.d/pg-hardstorage.conf
      - src: LICENSE
        dst: /usr/share/doc/pg-hardstorage/LICENSE
      - src: README.md
        dst: /usr/share/doc/pg-hardstorage/README.md
      - src: docs/reference/runbooks
        dst: /usr/share/pg-hardstorage/runbooks
        type: tree
    overrides:
      deb:
        recommends: [postgresql-client]
      rpm:
        recommends: [postgresql]

# Container images — distroless, multi-arch via buildx.
dockers:
  - id: pg_hardstorage-amd64
    ids: [pg_hardstorage]
    image_templates:
      - "ghcr.io/cybertec-postgresql/pg_hardstorage:{{ .Version }}-amd64"
      - "ghcr.io/cybertec-postgresql/pg_hardstorage:latest-amd64"
    dockerfile: deploy/docker/Dockerfile.goreleaser
    use: buildx
    goos: linux
    goarch: amd64
    build_flag_templates:
      - "--platform=linux/amd64"
      - "--label=org.opencontainers.image.source=https://github.com/cybertec-postgresql/pg_hardstorage"
      - "--label=org.opencontainers.image.version={{.Version}}"
      - "--label=org.opencontainers.image.licenses=Apache-2.0"
      - "--label=org.opencontainers.image.vendor=CYBERTEC PostgreSQL International GmbH"

  - id: pg_hardstorage-arm64
    ids: [pg_hardstorage]
    image_templates:
      - "ghcr.io/cybertec-postgresql/pg_hardstorage:{{ .Version }}-arm64"
      - "ghcr.io/cybertec-postgresql/pg_hardstorage:latest-arm64"
    dockerfile: deploy/docker/Dockerfile.goreleaser
    use: buildx
    goos: linux
    goarch: arm64
    build_flag_templates:
      - "--platform=linux/arm64"
      - "--label=org.opencontainers.image.source=https://github.com/cybertec-postgresql/pg_hardstorage"
      - "--label=org.opencontainers.image.version={{.Version}}"
      - "--label=org.opencontainers.image.licenses=Apache-2.0"
      - "--label=org.opencontainers.image.vendor=CYBERTEC PostgreSQL International GmbH"

docker_manifests:
  - name_template: "ghcr.io/cybertec-postgresql/pg_hardstorage:{{ .Version }}"
    image_templates:
      - "ghcr.io/cybertec-postgresql/pg_hardstorage:{{ .Version }}-amd64"
      - "ghcr.io/cybertec-postgresql/pg_hardstorage:{{ .Version }}-arm64"
  - name_template: "ghcr.io/cybertec-postgresql/pg_hardstorage:latest"
    image_templates:
      - "ghcr.io/cybertec-postgresql/pg_hardstorage:latest-amd64"
      - "ghcr.io/cybertec-postgresql/pg_hardstorage:latest-arm64"

# Keyless cosign signing of the published images + manifests (Sigstore +
# GitHub Actions OIDC), mirroring the blob `signs:` stanza. Only runs in
# the docker phase, i.e. when PUBLISH_CONTAINERS enables image publishing.
docker_signs:
  - id: cosign-images
    cmd: cosign
    artifacts: all
    args:
      - "sign"
      - "--yes"
      - "${artifact}@${digest}"
    output: true

release:
  github:
    owner: cybertec-postgresql
    name: pg_hardstorage
  draft: false
  prerelease: auto
  name_template: "v{{ .Version }}"
  header: |
    ## pg_hardstorage v{{ .Version }}

    See CHANGELOG.md for the full release notes.
  footer: |
    All artefacts are cosign-signed (keyless / Sigstore). Verify with:

    ```
    cosign verify-blob \
      --certificate-identity-regexp 'https://github.com/cybertec-postgresql/pg_hardstorage' \
      --certificate-oidc-issuer https://token.actions.githubusercontent.com \
      --certificate <artefact>.pem --signature <artefact>.sig \
      <artefact>
    ```