.goreleaser.yaml

version: 2

project_name: vulnapi

before:
  hooks:
    - go mod tidy
    - go generate ./...

builds:
  - env:
      - CGO_ENABLED=0
    goos:
      - linux
      - windows
      - darwin

gomod:
  proxy: true

checksum:
  name_template: "checksums.txt"

source:
  enabled: true

archives:
  - format: tar.gz
    name_template: >-
      {{ .ProjectName }}_
      {{- title .Os }}_
      {{- if eq .Arch "amd64" }}x86_64
      {{- else if eq .Arch "386" }}i386
      {{- else }}{{ .Arch }}{{ end }}
      {{- if .Arm }}v{{ .Arm }}{{ end }}
    # use zip for windows archives
    format_overrides:
    - goos: windows
      format: zip

snapshot:
  name_template: "{{ incpatch .Version }}-next"

sboms:
  - id: syft-archive
    artifacts: archive

signs:
  - cmd: cosign
    env:
      - COSIGN_EXPERIMENTAL=1
    certificate: "${artifact}.pem"
    args:
      - sign-blob
      - "--output-certificate=${certificate}"
      - "--output-signature=${signature}"
      - "${artifact}"
      - "--yes"
    artifacts: checksum
    output: true

changelog:
  sort: asc
  filters:
    exclude:
      - '^docs:'
      - '^test:'

milestones:
  - repo:
      owner: cerberauth
      name: vulnapi
    close: true
    fail_on_error: false

brews:
  - name: "{{ .ProjectName }}"
    description: "Scan your APIs for security vulnerabilities and weaknesses"
    license: "MIT"
    repository:
      owner: cerberauth
      name: "{{ .ProjectName }}"
    homepage: https://vulnapi.cerberauth.com/
    commit_author:
      name: Emmanuel Gautier
      email: emmanuel@cerberauth.com

chocolateys:
  - owners: CerberAuth
    authors: Emmanuel Gautier
    project_url: https://vulnapi.cerberauth.com/?utm_source=chocolatey
    icon_url: "https://avatars.githubusercontent.com/u/127022998"
    license_url: https://github.com/cerberauth/vulnapi/blob/main/LICENSE
    require_license_acceptance: false
    project_source_url: https://github.com/cerberauth/vulnapi
    docs_url: https://vulnapi.cerberauth.com/docs?utm_source=chocolatey
    bug_tracker_url: https://github.com/cerberauth/vulnapi/issues
    tags: "security vulnerability developer"
    summary: VulnAPI is an open-source project designed to help you scan your APIs for common security vulnerabilities and weaknesses.
    skip_publish: false
    api_key: "{{ .Env.CHOCOLATEY_API_KEY }}"
    source_repo: "https://push.chocolatey.org/"
    description: |
      VulnAPI is an open-source project designed to help you scan your APIs for common security vulnerabilities and weaknesses.

nfpms:
  - package_name: "{{ .ProjectName }}"
    vendor: CerberAuth
    homepage: https://vulnapi.cerberauth.com/?utm_source=nfpms
    maintainer: Emmanuel Gautier <emmanuel@cerberauth.com>
    description: |-
      VulnAPI is an open-source project designed to help you scan your APIs for common security vulnerabilities and weaknesses.
    license: "MIT"
    formats:
      - apk
      - deb
      - rpm
      - termux.deb
      - archlinux

snapcrafts:
  - title: vulnapi
    publish: true
    summary: "vulnapi"
    description: "vulnapi"
    license: MIT

dockers:
  - image_templates:
      - "cerberauth/vulnapi:{{ .Tag }}"
      - "cerberauth/vulnapi:v{{ .Major }}"
      - "cerberauth/vulnapi:v{{ .Major }}.{{ .Minor }}"
      - "cerberauth/vulnapi:latest"
      - "ghcr.io/cerberauth/vulnapi:{{ .Tag }}"
      - "ghcr.io/cerberauth/vulnapi:v{{ .Major }}"
      - "ghcr.io/cerberauth/vulnapi:v{{ .Major }}.{{ .Minor }}"
      - "ghcr.io/cerberauth/vulnapi:latest"
    dockerfile: .docker/Dockerfile-goreleaser

docker_signs:
  - cmd: cosign
    env:
      - COSIGN_EXPERIMENTAL=1
    artifacts: images
    output: true
    args:
      - "sign"
      - "${artifact}"
      - "--yes"