trufflehog/.goreleaser.yml at main · trufflesecurity/trufflehog · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
version: 2
release:
  # GoReleaser creates the GitHub release before artifacts finish uploading.
  # scripts/install.sh queries /releases/latest to find the current version, so
  # a premature "latest" flag causes install failures during the upload window.
  # The release workflow's mark-latest job promotes the release only after
  # GoReleaser completes successfully.
  make_latest: false
builds:
  - id: trufflehog-upx
    binary: trufflehog
    ldflags:
      - -s -w -X 'github.com/trufflesecurity/trufflehog/v3/pkg/version.BuildVersion={{ .Version }}'
    env: [CGO_ENABLED=0]
    goos:
    - linux
    goarch:
    - amd64
    - arm64
    hooks:
      post:
        - upx -q "{{ .Path }}"
  - id: trufflehog
    binary: trufflehog
    ldflags:
      - -X 'github.com/trufflesecurity/trufflehog/v3/pkg/version.BuildVersion={{ .Version }}'
    env: [CGO_ENABLED=0]
    goos:
    - darwin
    - windows
    goarch:
    - amd64
    - arm64
dockers:
  - image_templates: ["trufflesecurity/{{ .ProjectName }}:{{ .Version }}-amd64"]
    dockerfile: Dockerfile.goreleaser
    extra_files:
    - entrypoint.sh
    use: buildx
    build_flag_templates:
    - --platform=linux/amd64
    - --label=org.opencontainers.image.title={{ .ProjectName }}
    - --label=org.opencontainers.image.description={{ .ProjectName }}
    - --label=org.opencontainers.image.url=https://github.com/trufflesecurity/{{ .ProjectName }}
    - --label=org.opencontainers.image.source=https://github.com/trufflesecurity/{{ .ProjectName }}
    - --label=org.opencontainers.image.version={{ .Version }}
    - --label=org.opencontainers.image.revision={{ .FullCommit }}
    - --label=org.opencontainers.image.licenses=AGPL-3.0
    - --provenance=false
  - image_templates: ["trufflesecurity/{{ .ProjectName }}:{{ .Version }}-arm64v8"]
    goarch: arm64
    dockerfile: Dockerfile.goreleaser
    extra_files:
    - entrypoint.sh
    use: buildx
    build_flag_templates:
    - --platform=linux/arm64/v8
    - --label=org.opencontainers.image.title={{ .ProjectName }}
    - --label=org.opencontainers.image.description={{ .ProjectName }}
    - --label=org.opencontainers.image.url=https://github.com/trufflesecurity/{{ .ProjectName }}
    - --label=org.opencontainers.image.source=https://github.com/trufflesecurity/{{ .ProjectName }}
    - --label=org.opencontainers.image.version={{ .Version }}
    - --label=org.opencontainers.image.revision={{ .FullCommit }}
    - --label=org.opencontainers.image.licenses=AGPL-3.0
    - --provenance=false
  - image_templates: ["ghcr.io/trufflesecurity/{{ .ProjectName }}:{{ .Version }}-amd64"]
    dockerfile: Dockerfile.goreleaser
    extra_files:
    - entrypoint.sh
    use: buildx
    build_flag_templates:
    - --platform=linux/amd64
    - --label=org.opencontainers.image.title={{ .ProjectName }}
    - --label=org.opencontainers.image.description={{ .ProjectName }}
    - --label=org.opencontainers.image.url=https://github.com/trufflesecurity/{{ .ProjectName }}
    - --label=org.opencontainers.image.source=https://github.com/trufflesecurity/{{ .ProjectName }}
    - --label=org.opencontainers.image.version={{ .Version }}
    - --label=org.opencontainers.image.revision={{ .FullCommit }}
    - --label=org.opencontainers.image.licenses=AGPL-3.0
    - --provenance=false
  - image_templates: ["ghcr.io/trufflesecurity/{{ .ProjectName }}:{{ .Version }}-arm64v8"]
    goarch: arm64
    dockerfile: Dockerfile.goreleaser
    extra_files:
    - entrypoint.sh
    use: buildx
    build_flag_templates:
    - --platform=linux/arm64/v8
    - --label=org.opencontainers.image.title={{ .ProjectName }}
    - --label=org.opencontainers.image.description={{ .ProjectName }}
    - --label=org.opencontainers.image.url=https://github.com/trufflesecurity/{{ .ProjectName }}
    - --label=org.opencontainers.image.source=https://github.com/trufflesecurity/{{ .ProjectName }}
    - --label=org.opencontainers.image.version={{ .Version }}
    - --label=org.opencontainers.image.revision={{ .FullCommit }}
    - --label=org.opencontainers.image.licenses=AGPL-3.0
    - --provenance=false
docker_manifests:
  - name_template: trufflesecurity/{{ .ProjectName }}:{{ .Version }}
    image_templates:
    - trufflesecurity/{{ .ProjectName }}:{{ .Version }}-amd64
    - trufflesecurity/{{ .ProjectName }}:{{ .Version }}-arm64v8
  - name_template: trufflesecurity/{{ .ProjectName }}:latest
    image_templates:
    - trufflesecurity/{{ .ProjectName }}:{{ .Version }}-amd64
    - trufflesecurity/{{ .ProjectName }}:{{ .Version }}-arm64v8
  - name_template: ghcr.io/trufflesecurity/{{ .ProjectName }}:{{ .Version }}
    image_templates:
    - ghcr.io/trufflesecurity/{{ .ProjectName }}:{{ .Version }}-amd64
    - ghcr.io/trufflesecurity/{{ .ProjectName }}:{{ .Version }}-arm64v8
  - name_template: ghcr.io/trufflesecurity/{{ .ProjectName }}:latest
    image_templates:
    - ghcr.io/trufflesecurity/{{ .ProjectName }}:{{ .Version }}-amd64
    - ghcr.io/trufflesecurity/{{ .ProjectName }}:{{ .Version }}-arm64v8
brews:
  - repository:
      owner: trufflesecurity
      name: homebrew-trufflehog
      token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
    description: "Find credentials all over the place"
    name: "trufflehog"
    homepage: "https://github.com/trufflesecurity/trufflehog"
    install: |
      bin.install "trufflehog"
signs:
  - cmd: cosign
    signature: "${artifact}.sig"
    certificate: "${artifact}.pem"
    args:
      - "sign-blob"
      - "--oidc-issuer=https://token.actions.githubusercontent.com"
      - "--output-certificate=${certificate}"
      - "--output-signature=${signature}"
      - "${artifact}"
      - "--yes"
    artifacts: checksum