release.yml

name: release
on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:

      - name: Checkout
        uses: actions/checkout@v3
      
      - name: Unshallow
        run: git fetch --prune --unshallow
      
      - name: Set up Go
        uses: actions/setup-go@v3
        with:
          go-version-file: 'go.mod'
          cache: true

      - name: Google auth
        id: auth
        uses: 'google-github-actions/auth@v1'
        with: 
          credentials_json: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
      
      - name: Get secret
        id: secrets
        uses: 'google-github-actions/get-secretmanager-secrets@v1'
        with: 
          secrets: |-
            key:evertrust-internal/pgp-private-key
            
      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v5
        id: import_gpg
        with:
          gpg_private_key: ${{ steps.secrets.outputs.key }}
      
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v4
        with:
          version: latest
          args: release --rm-dist
        env:
          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
          # GitHub sets this automatically
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}