version: 2

before:

hooks:

- go mod tidy

builds:

- id: amux

main: ./cmd/amux

binary: amux

env:

- CGO_ENABLED=0

goos:

- darwin

- linux

goarch:

- amd64

- arm64

ldflags:

- -s -w

- -X main.version={{.Version}}

- -X main.commit={{.ShortCommit}}

- -X main.date={{.CommitDate}}

archives:

- id: default

format: tar.gz

name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"

files:

- LICENSE

- README.md

checksum:

name_template: "checksums.txt"

signs:

# Detached minisign signature over checksums.txt, so clients can verify the

# checksums were produced by the release signing key and not just fetched

# from the same (potentially compromised) release channel.

#

# -l pins minisign's legacy (non-prehashed) "Ed" signature format, which is

# what the embedded verifier (internal/update/signature.go) and install.sh

# expect. Do not drop -l: the default prehashed "ED" format will not verify.

#

# MINISIGN_SECRET_KEY_FILE is materialized by CI from a GitHub Actions

# secret (see .github/workflows/release.yml); the key never lives in-repo.

- id: checksums

cmd: minisign

args:

[

"-S",

"-l",

"-s",

"{{ .Env.MINISIGN_SECRET_KEY_FILE }}",

"-m",

"${artifact}",

"-x",

"${signature}",

]

artifacts: checksum

signature: "${artifact}.minisig"

changelog:

sort: asc

filters:

exclude:

- "^docs:"

- "^test:"

- "^ci:"

- "^chore:"

release:

github:

owner: andyrewlee

name: amux

draft: false

prerelease: auto

name_template: "v{{.Version}}"