|
16 | 16 | env: |
17 | 17 | DOCKER_CLI_EXPERIMENTAL: "enabled" |
18 | 18 | steps: |
| 19 | + # Setup steps - no external side effects. |
19 | 20 | - name: Checkout |
20 | 21 | uses: actions/checkout@v4 |
21 | 22 | with: |
|
43 | 44 | run: | |
44 | 45 | sudo apt-get update |
45 | 46 | sudo apt-get install -y upx |
| 47 | +
|
| 48 | + # GoReleaser pipeline (sequential, not atomic): |
| 49 | + # 1. build + archive + checksum + sign (local only, no side effects) |
| 50 | + # 2. homebrew tap update (commit to trufflesecurity/homebrew-trufflehog) |
| 51 | + # 3. docker images + manifests (DockerHub + GHCR, including :latest tags) |
| 52 | + # 4. github release creation (artifacts uploaded, make_latest: false) |
| 53 | + # |
| 54 | + # On failure: GoReleaser does not roll back completed phases. Depending |
| 55 | + # on where it failed, some subset of the above may have been published. |
| 56 | + # Check: |
| 57 | + # - Homebrew tap: https://github.com/trufflesecurity/homebrew-trufflehog |
| 58 | + # - DockerHub: https://hub.docker.com/r/trufflesecurity/trufflehog/tags |
| 59 | + # - GHCR: https://github.com/trufflesecurity/trufflehog/pkgs/container/trufflehog |
| 60 | + # - GH releases: https://github.com/trufflesecurity/trufflehog/releases |
| 61 | + # |
| 62 | + # If the GitHub release was created but artifacts are missing, the |
| 63 | + # install script (scripts/install.sh) will fail for users on that |
| 64 | + # version. The release is NOT marked latest (make_latest: false), so |
| 65 | + # /releases/latest still points to the previous good release. |
46 | 66 | - name: Run GoReleaser |
47 | 67 | uses: goreleaser/goreleaser-action@v6 |
48 | 68 | with: |
|
53 | 73 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
54 | 74 | HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }} |
55 | 75 | GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} |
| 76 | + |
| 77 | + # Promotes the GitHub release to "latest" only after the Release job fully |
| 78 | + # succeeds (including post-steps). At this point, all artifacts have been |
| 79 | + # published: Docker images and :latest tags are live, the Homebrew tap is |
| 80 | + # updated, binaries are attached to the GitHub release, and checksums are |
| 81 | + # signed. |
| 82 | + # |
| 83 | + # If this job fails, the release exists with all artifacts but is not flagged |
| 84 | + # as latest. /releases/latest and scripts/install.sh still point to the |
| 85 | + # previous release. To manually promote: |
| 86 | + # gh release edit <tag> --latest --repo trufflesecurity/trufflehog |
| 87 | + mark-latest: |
| 88 | + needs: Release |
| 89 | + runs-on: ubuntu-latest |
| 90 | + steps: |
56 | 91 | - name: Mark release as latest |
57 | | - run: gh release edit ${{ github.ref_name }} --latest |
| 92 | + run: gh release edit "$TAG" --latest |
58 | 93 | env: |
59 | | - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 94 | + GH_TOKEN: ${{ github.token }} |
| 95 | + GH_REPO: ${{ github.repository }} |
| 96 | + TAG: ${{ github.ref_name }} |
0 commit comments