version: 2

project_name: vantage

before:
  hooks:
    - go mod tidy

builds:
  - id: vantage
    main: .
    binary: vantage
    env:
      - CGO_ENABLED=0
    flags:
      - -trimpath
    ldflags:
      - -s -w
      - -X main.version={{ .Version }}
      - -X main.commit={{ .Commit }}
      - -X main.date={{ .CommitDate }}
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
    mod_timestamp: "{{ .CommitTimestamp }}"

archives:
  - id: default
    ids:
      - vantage
    name_template: >-
      {{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}
    formats:
      - tar.gz
    format_overrides:
      - goos: windows
        formats:
          - zip
    files:
      - README.md
      - LICENSE

checksum:
  name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt"
  algorithm: sha256

sboms:
  - artifacts: archive

# Native Linux packages. These attach to the GitHub release like any other
# artefact, so `dpkg -i` / `rpm -i` / `apk add` work from a downloaded file
# without standing up an apt or yum repository. Users get a managed install
# — man-page location, clean uninstall, package database entry — rather than
# a tarball they have to place on PATH themselves.
nfpms:
  - id: packages
    ids:
      - vantage
    package_name: vantage
    vendor: Adedayo Adetoye
    homepage: "https://github.com/adedayo/vantage"
    maintainer: "Dr. Adedayo Adetoye (Dayo) <https://github.com/adedayo>"
    description: |-
      See what an attacker sees.
      vantage audits the attack surface an organisation exposes, from the
      vantage point of someone looking at it.
    license: BSD-3-Clause
    formats:
      - deb
      - rpm
      - apk
      - archlinux
    bindir: /usr/bin
    # No runtime dependencies are declared because the binary is static:
    # builds set CGO_ENABLED=0, and resolver discovery reads /etc/resolv.conf
    # directly rather than through libc.
    contents:
      - src: LICENSE
        dst: /usr/share/doc/vantage/LICENSE
      - src: README.md
        dst: /usr/share/doc/vantage/README.md

# Homebrew. A Cask rather than a Formula: GoReleaser soft-deprecated `brews`
# in v2.10 and formally deprecated it in v2.16, because Formulas that install
# pre-compiled binaries were always a workaround and Homebrew now expects
# Casks for this. Deprecated options are only removed on major versions, so
# `brews` keeps working until v3 — this is about not writing new configuration
# against something already on its way out.
#
# The tap is adedayo/homebrew-tap, the same one checkmate publishes to, and
# the token is read from HOMEBREW_GITHUB_TOKEN to match. Pushing to another
# repository needs a token with contents:write on it — the workflow's default
# GITHUB_TOKEN is scoped to this repository and cannot do it.
#
# Casks must live in the tap's Casks directory, which is the default here.
# checkmate's Formula sits at the tap root; the two coexist.
#
# `skip_upload` is templated on the presence of the token so that a release
# still succeeds when the secret is absent: the cask is skipped and everything
# else publishes. Reading it with `index` rather than `.Env.HOMEBREW_GITHUB_TOKEN`
# is deliberate, since the latter aborts the whole release when the variable is
# unset.
homebrew_casks:
  - name: vantage
    ids:
      - default
    binaries:
      - vantage
    homepage: "https://github.com/adedayo/vantage"
    description: "See what an attacker sees: audit the attack surface an organisation exposes."
    caveats: "To get started, run: vantage --help"
    skip_upload: '{{ if index .Env "HOMEBREW_GITHUB_TOKEN" }}false{{ else }}true{{ end }}'
    repository:
      owner: adedayo
      name: homebrew-tap
      # No branch is pinned, so GoReleaser uses the tap's default branch.
      # That is currently master, which is not a Homebrew convention —
      # Homebrew's own repositories are all on main — but an artefact of the
      # tap being created in 2018, before GitHub changed the default. Leaving
      # it unpinned means renaming the tap's branch will not silently stop
      # cask updates.
      #
      # This must be exactly `{{ .Env.VAR }}`. GoReleaser validates the token
      # field for that shape specifically and rejects any other interpolation,
      # including `{{ index .Env "..." }}`, with:
      #   expected {{ .Env.VAR_NAME }} only (no plain-text or other interpolation)
      #
      # The workflow always defines HOMEBREW_GITHUB_TOKEN, falling back to
      # PAT_TOKEN and then to the empty string, so the key is always present
      # and this never fails on a missing variable. skip_upload above still
      # uses `index`, which is an ordinary template and unaffected.
      token: "{{ .Env.HOMEBREW_GITHUB_TOKEN }}"
    commit_author:
      name: "Dayo Adetoye"
      email: dayo.dev@gmail.com
    commit_msg_template: "vantage: update to {{ .Tag }}"
    # The binaries are not notarised — Apple charges yearly for that — so
    # macOS quarantines them and reports the download as damaged. Clearing the
    # attribute on install is Homebrew's documented workaround for unsigned
    # casks.
    #
    # This is written as a `custom_block` rather than the `hooks.post.install`
    # that GoReleaser documents for exactly this purpose, because that hook
    # renders a `postflight do … end` block and Homebrew has deprecated
    # arbitrary-Ruby flight blocks:
    #
    #   Warning: Calling `postflight` is deprecated! Use `postflight_steps`
    #   instead. Please report this issue to the adedayo/homebrew-tap tap
    #
    # That warning printed on every command that touched the tap, for every
    # user, and deprecation here is not idle: in the same cycle Homebrew
    # *disabled* `depends_on macos: :catalina`, which made a sibling cask
    # uninstallable with no warning beyond the ones already being ignored.
    # GoReleaser has no `postflight_steps` support, so the stanza is emitted
    # directly. `custom_block` is placed at the top of the cask definition;
    # stanza order is not significant to Homebrew.
    #
    # Two details make this safe to pass through GoReleaser's templating:
    #
    #   - No `{{ … }}` and no `#{ … }`. `chdir: "."` resolves against
    #     `postflight_steps`' default base, which is the staged path, so the
    #     binary is named relatively and no interpolation is needed. Writing
    #     `{{staged_path}}` — the token Homebrew would otherwise want — would
    #     be eaten by the Go template engine before Homebrew ever saw it.
    #   - `must_succeed: false` preserves the tolerance the old `if OS.mac?`
    #     guard provided. A binary carrying no such attribute, or a platform
    #     with no /usr/bin/xattr, must not turn a successful install into a
    #     failed one.
    custom_block: |
      postflight_steps do
        run "/usr/bin/xattr",
            args:         ["-dr", "com.apple.quarantine", "vantage"],
            chdir:        ".",
            must_succeed: false
      end
    # `brew uninstall --zap` should leave nothing behind. The cache holds
    # provider ranges and Certificate Transparency results, not configuration,
    # so removing it costs the user only a re-fetch.
    zap:
      trash:
        - "~/Library/Caches/vantage"

# Container images, published to GitHub Container Registry alongside the
# release. `dockers_v2` rather than `dockers`: the latter is deprecated and
# will be replaced by this in GoReleaser v3.
#
# Note that these are built during the *publish* phase, not the build phase,
# because buildx cannot assemble a multi-platform manifest without pushing
# it. A release run with --skip=publish therefore builds no images.
dockers_v2:
  - id: ghcr
    ids:
      - vantage
    images:
      - "ghcr.io/adedayo/vantage"
    tags:
      - "{{ .Version }}"
      - "v{{ .Version }}"
      - "{{ if not .Prerelease }}latest{{ end }}"
    platforms:
      - linux/amd64
      - linux/arm64
    annotations:
      "org.opencontainers.image.title": "{{ .ProjectName }}"
      "org.opencontainers.image.description": "See what an attacker sees: audit the attack surface an organisation exposes."
      "org.opencontainers.image.url": "https://github.com/adedayo/vantage"
      "org.opencontainers.image.source": "https://github.com/adedayo/vantage"
      "org.opencontainers.image.version": "{{ .Version }}"
      "org.opencontainers.image.revision": "{{ .FullCommit }}"
      "org.opencontainers.image.created": "{{ .Date }}"
      "org.opencontainers.image.licenses": "BSD-3-Clause"

# Windows Package Manager. Unlike Homebrew, winget has a single central
# repository — microsoft/winget-pkgs — and publishing means opening a pull
# request against it, which is then validated and merged by Microsoft's
# automation. That requires a fork of winget-pkgs under this account, and a
# token that can push to it and open pull requests.
#
# The token must be a *classic* PAT with the `public_repo` scope. A
# fine-grained token is not sufficient and cannot be made sufficient: it only
# acts on repositories owned by the accounts it was scoped to, so it pushes
# the branch to the fork happily and then fails to open the pull request on
# microsoft/winget-pkgs with `403 Resource not accessible by personal access
# token`. Note that the branch is pushed before the PR is attempted, so after
# such a failure the manifests are already on the fork and the pull request
# can be opened by hand for that version.
#
# Because the fork and token are prerequisites that may not be in place, the
# whole pipe is skipped when the token is absent rather than failing the
# release. The first successful run opens a PR; it is not merged
# automatically, and the package appears in winget only once Microsoft
# accepts it.
winget:
  - name: vantage
    package_identifier: adedayo.vantage
    publisher: Adedayo Adetoye
    publisher_url: "https://github.com/adedayo"
    publisher_support_url: "https://github.com/adedayo/vantage/issues/new"
    homepage: "https://github.com/adedayo/vantage"
    license: BSD-3-Clause
    license_url: "https://github.com/adedayo/vantage/blob/main/LICENSE"
    copyright: "Copyright (c) Adedayo Adetoye"
    short_description: "See what an attacker sees: audit the attack surface an organisation exposes."
    description: |-
      vantage reports what an organisation exposes to someone looking at it,
      and what that exposure would cost. It assesses mail authentication,
      delegation and DNSSEC, certificate issuance policy, hostnames published
      in Certificate Transparency logs, subdomain takeover, and which
      providers and jurisdictions the infrastructure resolves into.
    tags:
      - security
      - dns
      - attack-surface
      - golang
      - cli
    skip_upload: '{{ if index .Env "WINGET_GITHUB_TOKEN" }}false{{ else }}true{{ end }}'
    repository:
      owner: adedayo
      name: winget-pkgs
      branch: "vantage-{{ .Version }}"
      # Must be exactly `{{ .Env.VAR }}`; GoReleaser validates this field for
      # that shape specifically, as the Homebrew token above does.
      token: "{{ .Env.WINGET_GITHUB_TOKEN }}"
      pull_request:
        enabled: true
        draft: false
        base:
          owner: microsoft
          name: winget-pkgs
          branch: master

snapshot:
  version_template: "{{ incpatch .Version }}-next"

changelog:
  use: github
  sort: asc
  filters:
    exclude:
      - "^docs:"
      - "^test:"
      - "^chore:"
      - "^ci:"
      - "typo"
      - Merge pull request
      - Merge branch
  groups:
    - title: Features
      regexp: '^.*?feat(\(.+\))??!?:.+$'
      order: 0
    - title: Bug fixes
      regexp: '^.*?fix(\(.+\))??!?:.+$'
      order: 1
    - title: Security
      regexp: '^.*?sec(urity)?(\(.+\))??!?:.+$'
      order: 2
    - title: Others
      order: 999

release:
  github:
    owner: adedayo
    name: vantage
  draft: false
  prerelease: auto
  footer: |
    ## Install

    ```sh
    go install github.com/adedayo/vantage@{{ .Tag }}
    ```

    Or download a prebuilt binary for your platform from the assets below.
    Verify it against `{{ .ProjectName }}_{{ .Version }}_checksums.txt`.