ci: add automatic release

.github/workflows/release.yaml

@@ -0,0 +1,52 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*' # Trigger on version tags
+
+permissions:
+  contents: read
+
+jobs:
+  goreleaser:
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+    permissions:
+      contents: write  # for goreleaser/goreleaser-action to create a GitHub release
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+    - name: Run GoReleaser
+      id: run-goreleaser
+      uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
+      with:
+        version: latest
+        args: release --clean
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Generate subject
+      id: hash
+      env:
+        ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
+      run: |
+        set -euo pipefail
+
+        checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
+        echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
+
+  provenance:
+    needs: [goreleaser]
+    permissions:
+      actions: read # To read the workflow path.
+      id-token: write # To sign the provenance.
+      contents: write # To add assets to a release.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] # not pinned to avoid breaking it, use it to target refs/tags/vX.Y.Z
+    with:
+      base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
+      upload-assets: true # upload to a new release

.gitignore

@@ -5,4 +5,5 @@ node_modules/
 hack/config/Pulumi.*.yaml
 hack/.env
 
-test/test_bruteforce.py
+test/test_bruteforce.py
+dist/

.goreleaser.yaml

@@ -0,0 +1,33 @@
+version: 2
+
+builds: 
+  - skip: true
+
+archives:
+  - format: tar.gz
+    name_template: "{{ .ProjectName }}_{{ .Version }}"
+    files:
+      - LICENCE
+      - assets/**
+      - templates/**
+      - utils/**
+      - __init__.py
+      - api.py
+      - config.json
+      - decorators.py
+      - models.py
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+
+source:
+  enabled: true
+
+checksum: {}
+
+sboms:
+  - artifacts: source