.goreleaser.yaml

version: 2

before:
  hooks:
    - task install-deps docs mocks
    - go mod tidy

builds:
  - id: argo-watcher
    main: ./cmd/argo-watcher
    binary: argo-watcher
    env:
      - CGO_ENABLED=0
    ldflags:
      - -s -w -X github.com/shini4i/argo-watcher/internal/server.version={{.Version}}
    goos:
      - linux
    goarch:
      - amd64
      - arm64

  - id: client
    main: ./cmd/client
    binary: client
    env:
      - CGO_ENABLED=0
    ldflags:
      - -s -w
    goos:
      - linux
    goarch:
      - amd64
      - arm64

# dockers_v2 builds a multi-arch manifest per image in a single `docker buildx
# build --push`, and attaches an SBOM to each. OCI metadata is set via
# `annotations` (not `--label`) so it lands on the manifest index that GHCR
# reads for multi-arch images.
dockers_v2:
  # Server image
  - id: argo-watcher
    ids:
      - argo-watcher
    dockerfile: Dockerfile.server
    images:
      - 'ghcr.io/shini4i/argo-watcher'
    tags:
      - '{{ .Tag }}'
    platforms:
      - linux/amd64
      - linux/arm64
    extra_files:
      - web/dist
      - db/migrations
    flags:
      - "--pull"
    # Attach an SBOM to the image. This is the dockers_v2 default, set
    # explicitly since dockers_v2 is still experimental and defaults may shift.
    sbom: "true"
    annotations:
      org.opencontainers.image.created: "{{.Date}}"
      org.opencontainers.image.title: argo-watcher
      org.opencontainers.image.description: "A feedback loop for your GitOps workflow, bridging CI pipelines and Argo CD."
      org.opencontainers.image.revision: "{{.FullCommit}}"
      org.opencontainers.image.version: "{{.Version}}"
      org.opencontainers.image.source: "{{.GitURL}}"
      org.opencontainers.image.licenses: Apache-2.0

  # Client image
  - id: client
    ids:
      - client
    dockerfile: Dockerfile.client
    images:
      - 'ghcr.io/shini4i/argo-watcher-client'
    tags:
      - '{{ .Tag }}'
    platforms:
      - linux/amd64
      - linux/arm64
    flags:
      - "--pull"
    # Attach an SBOM to the image. This is the dockers_v2 default, set
    # explicitly since dockers_v2 is still experimental and defaults may shift.
    sbom: "true"
    annotations:
      org.opencontainers.image.created: "{{.Date}}"
      org.opencontainers.image.title: argo-watcher-client
      org.opencontainers.image.description: "CLI client for Argo Watcher, used from CI pipelines to track Argo CD rollouts."
      org.opencontainers.image.revision: "{{.FullCommit}}"
      org.opencontainers.image.version: "{{.Version}}"
      org.opencontainers.image.source: "{{.GitURL}}"
      org.opencontainers.image.licenses: Apache-2.0

archives:
  - formats: ['tar.gz']
    name_template: "{{ .ProjectName }}_{{ .Tag }}_{{ .Os }}_{{ .Arch }}"

sboms:
  - artifacts: archive

signs:
  - cmd: cosign
    # cosign v3 defaults to the new bundle format: the separate .sig/.pem
    # outputs are gone, replaced by a single .sigstore.json bundle written via
    # --bundle. Verify with: cosign verify-blob --bundle checksums.txt.sigstore.json checksums.txt
    signature: "${artifact}.sigstore.json"
    output: true
    artifacts: checksum
    args:
      - "sign-blob"
      - "--bundle=${signature}"
      - "${artifact}"
      - "--yes"

docker_signs:
  - cmd: cosign
    # Empty string selects the images built by dockers_v2 (which publishes a
    # multi-arch manifest per image, not separate `manifests` artifacts).
    artifacts: ""
    args:
      - "sign"
      - "${artifact}@${digest}"
      - "--yes"

checksum:
  name_template: 'checksums.txt'

changelog:
  use:
    github-native

release:
  prerelease: auto
  draft: false

  footer: |
    ## Docker Images
    - `ghcr.io/shini4i/argo-watcher:{{ .Tag }}`
    - `ghcr.io/shini4i/argo-watcher-client:{{ .Tag }}`