vendored-release.yml

name: Release

on:
  workflow_dispatch
  push:
    tags:
      - 'v*'

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write # to upload assets to releases
      attestations: write # to upload assets attestation for build provenance
      id-token: write # grant additional permission to attestation action to mint the OIDC token permission

    steps:
    - uses: actions/checkout@v4

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: 1.22

    - name: Vendor dependencies
      run: |
        go get
	go mod vendor
	tar cvf vib-vendored-deps.tar.xz *

    - name: Upload artifact
      uses: actions/upload-artifact@v4
      with:
	Name: Vendored Sources
	path: vib-vendored-deps.tar.xz

    - name: Upload a Release Asset
      if: github.repository == 'Vanilla-OS/Vib'
      if: startsWith(github.ref, 'ref/tags')
      uses: softprops/action-gh-release@v2
      with:
        files: vib-vendored-deps.tar.xz

    - name: Attest generated files
      if: github.repository == 'Vanilla-OS/Vib'
      if startsWith(github.ref, 'ref/tags')
      id: attest
      uses: actions/attest-build-provenance@v1
      with:
        subject-path: 'vib-vendored-deps.tar.xz'