update to work with immutable releases (#281)

Signed-off-by: Carlos Panato <ctadeu@gmail.com>

Author: cpanato

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
 
     outputs:
       hashes: ${{ steps.hash.outputs.hashes }}
-      tag_name: ${{ steps.tag.outputs.tag_name }}
+      tag_name: ${{ steps.get_tag.outputs.tag_name }}
 
     runs-on: ubuntu-latest
 
@@ -90,3 +90,24 @@ jobs:
       base64-subjects: "${{ needs.release.outputs.hashes }}"
       upload-assets: true # upload to a new release
       upload-tag-name: "${{ needs.release.outputs.tag_name }}"
+      # GoReleaser leaves the release as a draft; keep it that way when
+      # attaching the provenance, otherwise the upload would target an
+      # immutable (published) release and fail.
+      draft-release: "true"
+
+  # Publish the draft release only after every asset (GoReleaser artifacts and
+  # SLSA provenance) has been attached, since a published release is immutable.
+  publish-release:
+    needs:
+      - release
+      - provenance
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # To publish the draft release.
+    steps:
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          TAG_NAME: ${{ needs.release.outputs.tag_name }}
+        run: gh release edit "${TAG_NAME}" --draft=false

.goreleaser.yml

@@ -28,7 +28,7 @@ builds:
       - arm64
       - arm
     goarm:
-      - 7
+      - "7"
     ldflags: |
       -X github.com/prometheus/common/version.Version={{.Version}}
       -X github.com/prometheus/common/version.Revision={{.Commit}}
@@ -37,7 +37,8 @@ builds:
       -X github.com/prometheus/common/version.BuildDate={{.Date}}
 
 archives:
-  - format: binary
+  - formats:
+      - binary
     allow_different_binary_count: true
 
 checksum:
@@ -60,7 +61,8 @@ kos:
   - id: ko-image
     main: .
     base_image: cgr.dev/chainguard/static
-    repository: ghcr.io/cpanato
+    repositories:
+      - ghcr.io/cpanato
     platforms:
       - all
     tags:
@@ -75,5 +77,8 @@ release:
   github:
     owner: cpanato
     name: github_actions_exporter
-  draft: false
+  # Keep the release as a draft so the pipeline can still add assets to it
+  # (immutable releases forbid uploading assets once published). The release
+  # workflow publishes it in its last job.
+  draft: true
   prerelease: allow