.goreleaser.yml

# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
version: 2

project_name: rig

before:
  hooks:
    - go mod tidy

builds:
  - id: rig
    main: .
    binary: rig
    env:
      - CGO_ENABLED=0
    flags:
      - -trimpath
    ldflags:
      - -s -w
      - -X thoreinstein.com/rig/cmd.Version={{.Version}}
      - -X thoreinstein.com/rig/cmd.commit={{.Commit}}
      - -X thoreinstein.com/rig/cmd.date={{.Date}}
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
    ignore:
      # Windows ARM64 is less common and harder to cross-compile
      - goos: windows
        goarch: arm64


archives:
  - id: default
    formats:
      - tar.gz
    name_template: >-
      {{ .ProjectName }}_
      {{- .Version }}_
      {{- .Os }}_
      {{- .Arch }}
    format_overrides:
      - goos: windows
        formats:
          - zip
    files:
      - README.md
      - LICENSE*

checksum:
  name_template: checksums.txt
  algorithm: sha256

# Keyless signing with Sigstore (no secrets required)
signs:
  - cmd: cosign
    artifacts: checksum
    output: true
    signature: "${artifact}.bundle"
    args:
      - sign-blob
      - "--yes"
      - "--bundle=${signature}"
      - "${artifact}"

# Generate Software Bill of Materials for supply chain transparency
sboms:
  - artifacts: archive
    documents:
      - "${artifact}.sbom.json"

snapshot:
  version_template: "{{ incpatch .Version }}-next"

changelog:
  sort: asc
  use: github
  filters:
    exclude:
      - "^docs:"
      - "^test:"
      - "^ci:"
      - "^chore:"
      - Merge pull request
      - Merge branch
  groups:
    - title: Features
      regexp: '^.*?feat(\([[:word:]]+\))??!?:.+$'
      order: 0
    - title: Bug Fixes
      regexp: '^.*?fix(\([[:word:]]+\))??!?:.+$'
      order: 1
    - title: Other
      order: 999

homebrew_casks:
  - name: rig
    repository:
      owner: thoreinstein
      name: homebrew-tap
      branch: main
      token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
    directory: Casks
    homepage: https://github.com/thoreinstein/rig
    description: "Developer workflow automation CLI for Git worktrees, Tmux, and Obsidian integration"
    license: "Unlicense"

    # CLI binaries (replaces install: block)
    binaries:
      - rig

    # Auto-remove macOS quarantine on install
    hooks:
      post:
        install: |
          if OS.mac?
            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/rig"]
          end

    # URL verification for brew audit
    url:
      verified: "github.com/thoreinstein/rig/"

release:
  github:
    owner: thoreinstein
    name: rig
  draft: false
  prerelease: auto
  mode: replace
  header: |
    ## Rig {{ .Version }}

    **Homebrew Installation (Recommended):**
    ```bash
    brew install thoreinstein/tap/rig
    rig version  # Should output: rig version {{ .Version }}
    ```

    **Manual Download:**
    Download the appropriate archive below for your platform, extract it, and move the `rig` binary to your PATH.

    Note: Homebrew installation automatically handles macOS code signing. Manual downloads work without additional configuration.

    ### Verifying Release Signatures

    All releases are signed with [keyless Sigstore](https://www.sigstore.dev/). To verify:

    ```bash
    # Install cosign: https://docs.sigstore.dev/cosign/system_config/installation/
    cosign verify-blob \
      --bundle checksums.txt.bundle \
      --certificate-identity 'https://github.com/thoreinstein/rig/.github/workflows/release.yml@refs/tags/{{ .Tag }}' \
      --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
      checksums.txt
    ```
  footer: |
    **Full Changelog**: https://github.com/thoreinstein/rig/compare/{{ .PreviousTag }}...{{ .Tag }}
  name_template: "v{{ .Version }}"