Merge remote-tracking branch 'origin/master' into cache

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

# Conflicts:
#	dist/index.js

.dockerignore

@@ -1,2 +1,12 @@
 /coverage
-/node_modules
+
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# yarn v2
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz
+.pnp.*

.eslintignore

@@ -0,0 +1,3 @@
+/dist/**
+/coverage/**
+/node_modules/**

.eslintrc.json

@@ -0,0 +1,24 @@
+{
+  "env": {
+    "node": true,
+    "es6": true,
+    "jest": true
+  },
+  "extends": [
+    "eslint:recommended",
+    "plugin:@typescript-eslint/eslint-recommended",
+    "plugin:@typescript-eslint/recommended",
+    "plugin:jest/recommended",
+    "plugin:prettier/recommended"
+  ],
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "ecmaVersion": "latest",
+    "sourceType": "module"
+  },
+  "plugins": [
+    "@typescript-eslint",
+    "jest",
+    "prettier"
+  ]
+}

.gitattributes

@@ -1,2 +1,2 @@
-/dist/** linguist-generated=true
-/lib/** linguist-generated=true
+/dist/** linguist-generated=true -diff
+/lib/** linguist-generated=true -diff

.github/FUNDING.yml

@@ -1,2 +1,3 @@
-github: crazy-max
-custom: https://www.paypal.me/crazyws
+github: [crazy-max, caarlos0]
+open_collective: goreleaser
+custom: ["https://goreleaser.com/pro"]

.github/dependabot.yml

@@ -3,18 +3,28 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
-      time: "06:00"
-      timezone: "Europe/Paris"
+      interval: monthly
     labels:
       - "dependencies"
+    commit-message:
+      prefix: "ci"
+      include: "scope"
+    groups:
+      actions:
+        patterns:
+          - "*"
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
-      interval: "daily"
-      time: "06:00"
-      timezone: "Europe/Paris"
+      interval: monthly
     allow:
       - dependency-type: "production"
     labels:
       - "dependencies"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      npm:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -1,8 +1,17 @@
 name: ci
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   schedule:
-    - cron: '0 10 * * *' # everyday at 10am
+    - cron: '0 10 * * *'
+  workflow_dispatch:
   push:
     branches:
       - 'master'
@@ -10,9 +19,6 @@ on:
     tags:
       - 'v*'
   pull_request:
-    branches:
-      - 'master'
-      - 'releases/v*'
 
 jobs:
   ci:
@@ -22,35 +28,38 @@ jobs:
       matrix:
         os:
           - ubuntu-latest
-          - macOS-latest
+          - macos-latest
           - windows-latest
         version:
           - latest
-          - v0.145.0
+          - '~> 2.13'
+        distribution:
+          - goreleaser
+          - goreleaser-pro
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v2
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      -
-        name: Set up Go
-        uses: actions/setup-go@v2
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.15
-      -
-        name: Check
+          go-version: stable
+      - name: Check
         uses: ./
         with:
           version: ${{ matrix.version }}
-          args: check --debug
+          args: check --verbose
           workdir: ./test
-      -
-        name: GoReleaser
+      - name: GoReleaser
+        if: ${{ !(github.event_name == 'pull_request' && matrix.distribution == 'goreleaser-pro') }}
         uses: ./
+        env:
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
         with:
+          distribution: ${{ matrix.distribution }}
           version: ${{ matrix.version }}
-          args: release --skip-publish --rm-dist
+          args: release --skip=publish --clean --snapshot
           workdir: ./test
 
   install-only:
@@ -60,28 +69,58 @@ jobs:
       matrix:
         version:
           - latest
-          - v0.145.0
+          - '~> 2.13'
+        distribution:
+          - goreleaser
+          - goreleaser-pro
+        cosign:
+          - true
+          - false
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v2
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      -
-        name: Set up Go
-        uses: actions/setup-go@v2
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.15
-      -
-        name: GoReleaser
+          go-version: 1.18
+      - name: Install cosign
+        if: matrix.cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - name: GoReleaser
+        if: ${{ !(github.event_name == 'pull_request' && matrix.distribution == 'goreleaser-pro') }}
         uses: ./
         with:
+          distribution: ${{ matrix.distribution }}
           version: ${{ matrix.version }}
           install-only: true
-      -
-        name: Check
+      - name: Check
+        if: ${{ !(github.event_name == 'pull_request' && matrix.distribution == 'goreleaser-pro') }}
         run: |
-          goreleaser check --debug
+          goreleaser check --verbose
+
+  cache-binary:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # The first workflow run saves the binary, later runs restore it.
+      - name: GoReleaser
+        uses: ./
+        with:
+          version: '~> v2'
+          install-only: true
+          cache-binary: true
+      - name: Check
+        run: goreleaser --version
 
   signing:
     runs-on: ${{ matrix.os }}
@@ -91,41 +130,36 @@ jobs:
       matrix:
         os:
           - ubuntu-latest
-          - macOS-latest
+          - macos-latest
           - windows-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v2
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      -
-        name: Set up Go
-        uses: actions/setup-go@v2
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.15
-      -
-        name: Import GPG key
+          go-version: 1.18
+      - name: Import GPG key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v3
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
         with:
-          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY_TEST }}
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY_TEST }}
           passphrase: ${{ secrets.PASSPHRASE_TEST }}
-      -
-        name: Check
+      - name: Check
         uses: ./
         with:
           version: latest
-          args: -f .goreleaser-signing.yml check --debug
+          args: -f .goreleaser-signing.yml check --verbose
           workdir: ./test
         env:
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
-      -
-        name: GoReleaser
+      - name: GoReleaser
         uses: ./
         with:
           version: latest
-          args: -f .goreleaser-signing.yml release --skip-publish --rm-dist
+          args: -f .goreleaser-signing.yml release --skip=publish --clean --snapshot
           workdir: ./test
         env:
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
@@ -133,31 +167,81 @@ jobs:
   upload-artifact:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v2
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      -
-        name: Set up Go
-        uses: actions/setup-go@v2
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.15
-      -
-        name: Check
+          go-version: 1.18
+      - name: Check
         uses: ./
         with:
-          args: check --debug
+          args: check --verbose
           workdir: ./test
-      -
-        name: GoReleaser
+      - name: GoReleaser
         uses: ./
         with:
-          args: release --skip-publish --rm-dist
+          args: release --skip=publish --clean --snapshot
           workdir: ./test
-      -
-        name: Upload assets
-        uses: actions/upload-artifact@v2
+      - name: Upload assets
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: myapp
           path: ./test/dist/*
+
+  dist:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: 1.18
+      - name: GoReleaser
+        uses: ./
+        with:
+          args: release --config .goreleaser-dist.yml --skip=publish --clean --snapshot
+          workdir: ./test
+      - name: Check dist
+        run: |
+          tree -nh ./test/_output
+
+  nightly:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - windows-latest
+        distribution:
+          - goreleaser-pro
+          - goreleaser
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: 1.18
+      - name: GoReleaser
+        uses: ./
+        with:
+          install-only: true
+          distribution: ${{ matrix.distribution }}
+          version: nightly
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Check
+        run: |
+          goreleaser check -f ./test/.goreleaser.yml
+          goreleaser --version
+          goreleaser --version | grep nightly

.github/workflows/release-major-tag.yml

@@ -0,0 +1,42 @@
+name: release major tag
+
+run-name: Move ${{ github.event.inputs.major_version }} to ${{ github.event.inputs.target }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: The tag, branch, or SHA the major version should point to (e.g. v7.1.0)
+        required: true
+      major_version:
+        type: choice
+        description: The major version tag to move
+        options:
+          - v7
+          - v6
+          - v5
+          - v4
+          - v3
+          - v2
+          - v1
+
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Git config
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+      - name: Move ${{ github.event.inputs.major_version }} to ${{ github.event.inputs.target }}
+        run: git tag -f ${{ github.event.inputs.major_version }} ${{ github.event.inputs.target }}
+      - name: Push
+        run: git push origin ${{ github.event.inputs.major_version }} --force

.github/workflows/test.yml

@@ -1,36 +1,42 @@
 name: test
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   push:
     branches:
       - 'master'
       - 'releases/v*'
   pull_request:
-    branches:
-      - 'master'
-      - 'releases/v*'
 
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v2
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      -
-        name: Validate
-        uses: docker/bake-action@v1
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          targets: validate
-      -
-        name: Test
-        uses: docker/bake-action@v1
+          node-version-file: '.node-version'
+          cache: npm
+      - name: Install cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - name: Install dependencies
+        run: npm ci
+      - name: Test
+        run: npm test
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload coverage
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
-          targets: test
-      -
-        name: Upload coverage
-        uses: codecov/codecov-action@v1
-        with:
-          file: ./coverage/clover.xml
+          files: ./coverage/clover.xml

.github/workflows/validate.yml

@@ -0,0 +1,83 @@
+name: validate
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'releases/v*'
+  pull_request:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: '.node-version'
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
+      - name: Format check
+        run: npm run format-check
+      - name: Lint
+        run: npm run lint
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6.0.0
+        with:
+          node-version-file: '.node-version'
+          cache: npm
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+      - name: Rebuild dist
+        run: npm run build
+      - name: Compare dist
+        id: diff
+        run: |
+          if [ "$(git diff --ignore-space-at-eol dist | wc -l)" -gt "0" ]; then
+            echo "Detected uncommitted changes after build. Run 'npm run build' and commit dist/." >&2
+            git diff dist
+            exit 1
+          fi
+      - name: Upload built dist on failure
+        if: ${{ failure() && steps.diff.conclusion == 'failure' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist
+
+  vendor:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6.0.0
+        with:
+          node-version-file: '.node-version'
+          cache: npm
+      - name: Refresh package-lock.json
+        run: npm install --package-lock-only
+      - name: Compare package-lock.json
+        run: |
+          if [ -n "$(git status --porcelain -- package-lock.json)" ]; then
+            echo "package-lock.json is out of sync with package.json. Run 'npm install' and commit." >&2
+            git diff package-lock.json
+            exit 1
+          fi

.gitignore

@@ -1,19 +1,11 @@
-/.dev
-node_modules/
-lib
+# https://raw.githubusercontent.com/github/gitignore/main/Node.gitignore
 
-# Jetbrains
-/.idea
-/*.iml
-
-# Rest of the file pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
 # Logs
 logs
 *.log
 npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
 lerna-debug.log*
+.pnpm-debug.log*
 
 # Diagnostic reports (https://nodejs.org/api/report.html)
 report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
@@ -24,34 +16,14 @@ pids
 *.seed
 *.pid.lock
 
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
 # Coverage directory used by tools like istanbul
 coverage
 *.lcov
 
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
 # Dependency directories
+node_modules/
 jspm_packages/
 
-# TypeScript v1 declaration files
-typings/
-
 # TypeScript cache
 *.tsbuildinfo
 
@@ -61,36 +33,11 @@ typings/
 # Optional eslint cache
 .eslintcache
 
-# Optional REPL history
-.node_repl_history
 
-# Output of 'npm pack'
-*.tgz
-
-# Yarn Integrity file
-.yarn-integrity
-
-# dotenv environment variables file
+# dotenv environment variable files
 .env
-.env.test
-
-# parcel-bundler cache (https://parceljs.org/)
-.cache
-
-# next.js build output
-.next
-
-# nuxt.js build output
-.nuxt
-
-# vuepress build output
-.vuepress/dist
-
-# Serverless directories
-.serverless/
-
-# FuseBox cache
-.fusebox/
-
-# DynamoDB Local files
-.dynamodb/
+.env.development.local
+.env.test.local
+.env.production.local
+.env.local
+provenance.json

.kodiak.toml

@@ -1,15 +0,0 @@
-version = 1
-
-[merge]
-automerge_label = "automerge"
-blacklist_title_regex = "^WIP.*"
-method = "squash"
-delete_branch_on_merge = true
-block_on_reviews_requested = false
-notify_on_conflict = true
-optimistic_updates = true
-
-[merge.message]
-title = "pull_request_title"
-include_pr_number = true
-body_type = "markdown"

.node-version

@@ -0,0 +1 @@
+24

.prettierignore

@@ -0,0 +1,6 @@
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# yarn v2
+.yarn/

CHANGELOG.md

@@ -1,132 +0,0 @@
-# Changelog
-
-## 2.5.0 (2021/03/31)
-
-* Bump y18n from 4.0.0 to 4.0.1 (#272)
-* Bump @actions/http-client from 1.0.9 to 1.0.11 (#270)
-* Enhance workflow (#271)
-* Bump node-notifier from 8.0.0 to 8.0.1 (#263)
-
-## 2.4.1 (2020/12/02)
-
-* Do not overwrite GORELEASER_CURRENT_TAG if already declared (#260)
-
-## 2.4.0 (2020/11/30)
-
-* Set GORELEASER_CURRENT_TAG (#259)
-* Container based developer flow (#258)
-* Upload artifact example (#257)
-* Bump @actions/tool-cache from 1.6.0 to 1.6.1 (#256)
-
-## 2.3.0 (2020/11/06)
-
-* Add install-only option for using goreleaser in user scripts (#252)
-* Update deps
-
-## 2.2.1 (2020/10/01)
-
-* Fix CVE-2020-15228
-
-## 2.2.0 (2020/08/27)
-
-* Use GITHUB_REF to retrieve tag before checking the most recent tag (#238)
-* Update deps
-
-## 2.1.1 (2020/06/24)
-
-* Fix workdir (#224)
-
-## 2.1.0 (2020/06/15)
-
-* Implement (optional) semver parsing of version (#213)
-* Remove unshallow step (goreleaser/goreleaser#1608)
-
-## 2.0.2 (2020/05/10)
-
-* Use template in `sign.args`
-
-## 2.0.1 (2020/05/10)
-
-* Dummy release to mark v2 as latest on the marketplace
-
-## 2.0.0 (2020/05/10)
-
-* Remove `key` input and use [Import GPG](https://github.com/crazy-max/ghaction-import-gpg) GitHub Action instead.
-* Make `args` input as required
-* Go 1.14
-* Update deps
-
-## 1.5.1 (2020/05/10)
-
-* Mark `key` input as deprecated
-
-## 1.5.0 (2020/05/07)
-
-* Use native GitHub Action tools to download assets and use GitHub API
-* Fix unexpected output when tag not found
-* Use GitHub Action exec
-* Cleanup local paths from extra fields
-* Add notes about limitation with GITHUB_TOKEN (#58)
-* Add Codecov
-
-## 1.4.0 (2020/04/09)
-
-* Use ncc and clean workflows
-* Update deps
-
-## 1.3.1 (2020/02/14)
-
-* Don't fail on `getTag` (#98)
-
-## 1.3.0 (2020/02/11)
-
-* Improve git tag detection (#77)
-* Only handle snapshot flag for release cmd (#94)
-* Use `core.info` instead of `console.log`
-* Update deps
-* Update gitattributes
-
-## 1.2.1 (2020/01/20)
-
-* Update deps
-
-## 1.2.0 (2019/12/24)
-
-* Update deps
-
-## 1.1.0 (2019/12/02)
-
-* Add input to run GoReleaser from a subdirectory (#45)
-
-## 1.0.2 (2019/11/14)
-
-* Fix tsc gen
-
-## 1.0.1 (2019/11/14)
-
-* Update deps
-
-## 1.0.0 (2019/10/04)
-
-* Stable release
-* Update deps
-
-## 0.4.0 (2019/09/28)
-
-* Move repository to GoReleaser org (#3)
-
-## 0.3.0 (2019/09/26)
-
-* Artifact signing (#2)
-
-## 0.2.1 (2019/09/22)
-
-* Typo
-
-## 0.2.0 (2019/09/20)
-
-* Snapshot forced if no tag found
-
-## 0.1.0 (2019/09/20)
-
-* Initial version

CONTRIBUTING.md

@@ -0,0 +1,89 @@
+# Contributing
+
+Thanks for your interest in contributing!
+
+## Prerequisites
+
+- [Node.js](https://nodejs.org/) — version pinned in [`.node-version`](./.node-version).
+  Tools like [`nvm`](https://github.com/nvm-sh/nvm), [`fnm`](https://github.com/Schniz/fnm),
+  [`asdf`](https://asdf-vm.com/), or [`mise`](https://mise.jdx.dev/) read this file
+  automatically.
+- [`cosign`](https://docs.sigstore.dev/cosign/installation/) — only required if you
+  want to run the signature-verification integration tests locally.
+
+## Setup
+
+```sh
+npm ci
+```
+
+## Pre-commit checklist
+
+Before committing changes to `src/`, `__tests__/`, `package.json`,
+`package-lock.json`, or `action.yml`:
+
+```sh
+npm run pre-checkin
+```
+
+That runs `format` + `build` + `test` — the same checks CI runs.
+
+Then commit `dist/` along with your source changes; the action runtime loads
+`dist/index.js` directly, so it must stay in sync.
+
+If CI's `validate / build` job fails because `dist/` differs from a fresh
+build, just download the `dist` artifact from the failed run and commit it —
+or rerun `npm run build` locally with the Node version in `.node-version`.
+
+## npm scripts
+
+| Script              | Purpose                                          |
+| ------------------- | ------------------------------------------------ |
+| `npm run build`     | Bundle `src/` to `dist/index.js` via `ncc`       |
+| `npm run format`    | Run Prettier (write)                             |
+| `npm run format-check` | Run Prettier (check only, used in CI)         |
+| `npm run lint`      | Run ESLint (check only, used in CI)              |
+| `npm run lint:fix`  | Run ESLint with `--fix`                          |
+| `npm test`          | Run Jest with coverage                           |
+| `npm run pre-checkin` | `format` + `lint:fix` + `build` + `test`       |
+
+## Tests
+
+`npm test` runs the full Jest suite, including integration tests that:
+
+- Download real GoReleaser releases from GitHub
+- Verify `checksums.txt` against the downloaded archive
+- Verify the cosign sigstore bundle (skipped if `cosign` isn't on `PATH`,
+  but the CI image always has it installed)
+
+These need outbound network access. Offline / restrictive-proxy runs will
+have those tests fail — that's expected.
+
+## Commit messages
+
+Use [Conventional Commits](https://www.conventionalcommits.org/) (`feat:`,
+`fix:`, `test:`, `docs:`, `chore:`, `ci:`, …). Keep the subject ≤72 chars.
+
+## Pull requests
+
+- Target `master`.
+- Make sure `npm run pre-checkin` passes.
+- One logical change per PR is easier to review.
+- The `signing` CI job and `goreleaser-pro` matrix entries are skipped on PRs
+  from forks because they need repository secrets — that's expected and not
+  something you need to fix.
+
+## Releasing (maintainers)
+
+1. Create a new GitHub Release with a semver tag (e.g. `v7.1.0`) — either
+   through the UI or `gh release create v7.1.0 --generate-notes`.
+2. Once the release exists, run the [**release major tag**](./.github/workflows/release-major-tag.yml)
+   workflow from the Actions tab:
+   - `target`: the new tag (e.g. `v7.1.0`)
+   - `major_version`: the major version to repoint (e.g. `v7`)
+
+   This force-pushes the major tag to the new release so consumers using
+   `goreleaser/goreleaser-action@v7` pick up the change.
+
+   The same workflow doubles as a rollback tool — pass an older tag as
+   `target` to revert the major.

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2019-2021 CrazyMax
+Copyright (c) 2019-2022 CrazyMax
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -5,9 +5,8 @@
   <p align="center">
     <a href="https://github.com/goreleaser/goreleaser-action/releases/latest"><img alt="GitHub release" src="https://img.shields.io/github/release/goreleaser/goreleaser-action.svg?logo=github&style=flat-square"></a>
     <a href="https://github.com/marketplace/actions/goreleaser-action"><img alt="GitHub marketplace" src="https://img.shields.io/badge/marketplace-goreleaser--action-blue?logo=github&style=flat-square"></a>
-    <a href="https://github.com/goreleaser/goreleaser-action/actions?workflow=test"><img alt="Test workflow" src="https://img.shields.io/github/workflow/status/goreleaser/goreleaser-action/test?label=test&logo=github&style=flat-square"></a>
+    <a href="https://github.com/goreleaser/goreleaser-action/actions?workflow=test"><img alt="Test workflow" src="https://img.shields.io/github/actions/workflow/status/goreleaser/goreleaser-action/test.yml?label=test&branch=master&logo=github&style=flat-square"></a>
     <a href="https://codecov.io/gh/goreleaser/goreleaser-action"><img alt="Codecov" src="https://img.shields.io/codecov/c/github/goreleaser/goreleaser-action?logo=codecov&style=flat-square"></a>
-    <a href="https://github.com/sponsors/crazy-max"><img src="https://img.shields.io/badge/sponsor-crazy--max-181717.svg?logo=github&style=flat-square" alt="Become a sponsor"></a>
   </p>
 </p>
 
@@ -17,12 +16,15 @@ ___
 
 * [Usage](#usage)
   * [Workflow](#workflow)
+  * [Verification](#verification)
   * [Run on new tag](#run-on-new-tag)
   * [Signing](#signing)
   * [Upload artifacts](#upload-artifacts)
   * [Install Only](#install-only)
+  * [Cache the binary](#cache-the-binary)
 * [Customizing](#customizing)
   * [inputs](#inputs)
+  * [outputs](#outputs)
   * [environment variables](#environment-variables)
 * [Limitation](#limitation)
 * [Development](#development)
@@ -30,6 +32,12 @@ ___
 
 ## Usage
 
+GoReleaser Action runs [goreleaser][], please follow its [docs][gdocs] for
+more information about how to customize what GoReleaser does.
+
+[goreleaser]: https://goreleaser.com/
+[gdocs]: https://goreleaser.com/customization
+
 ### Workflow
 
 ```yaml
@@ -39,31 +47,80 @@ on:
   pull_request:
   push:
 
+permissions:
+  contents: write
+
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       -
         name: Set up Go
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.15
+        uses: actions/setup-go@v6
       -
         name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v7
         with:
-          version: latest
-          args: release --rm-dist
+          # either 'goreleaser' (default) or 'goreleaser-pro'
+          distribution: goreleaser
+          # 'latest', 'nightly', or a semver
+          version: '~> v2'
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Your GoReleaser Pro key, if you are using the 'goreleaser-pro' distribution
+          # GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+```
+
+> **IMPORTANT**: note the `fetch-depth: 0` input in `Checkout` step. It is required  for the changelog to work correctly.
+
+### Verification
+
+The action verifies the integrity of the downloaded GoReleaser archive
+against the published `checksums.txt` automatically — no configuration
+required.
+
+If [`cosign`](https://docs.sigstore.dev/cosign/) is available on `PATH`, the
+action will additionally verify the cosign sigstore signature of the
+checksums file against the GoReleaser release workflow's OIDC identity. If
+`cosign` isn't installed, this step is silently skipped.
+
+> **Note**: cosign signature verification requires GoReleaser **v2.13.0 or
+> newer** (and the matching `nightly`). Earlier releases ship a `.sig`
+> detached signature signed with cosign v2, which is not compatible with
+> the cosign v3 sigstore-bundle format the action verifies. For older
+> versions the cosign step is silently skipped — only the `checksums.txt`
+> SHA-256 verification runs.
+
+> **Note**: when `version: nightly` is used, the action resolves the
+> latest immutable `vX.Y.Z-<sha>-nightly` release from the GitHub
+> Releases API. Pass `GITHUB_TOKEN` to the action step (as in the example
+> above) to avoid unauthenticated API rate limits.
+
+To enable signature verification, install cosign before running the action:
+
+```yaml
+      -
+        name: Install cosign
+        uses: sigstore/cosign-installer@v3
+      -
+        name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: '~> v2'
+          args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
 
-> **IMPORTANT**: note the `fetch-depth: 0` input in `Checkout` step. It is required  for the changelog to work correctly.
+Both checksum and signature verification work for tagged releases (≥ v2.13.0)
+and the `nightly` channel.
 
 ### Run on new tag
 
@@ -81,11 +138,11 @@ Or with a condition on GoReleaser step:
 ```yaml
       -
         name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v7
         if: startsWith(github.ref, 'refs/tags/')
         with:
-          version: latest
-          args: release --rm-dist
+          version: '~> v2'
+          args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
@@ -94,22 +151,23 @@ Or with a condition on GoReleaser step:
 
 ### Signing
 
-If [signing is enabled](https://goreleaser.com/customization/#Signing) in your GoReleaser configuration, you can use the [Import GPG](https://github.com/crazy-max/ghaction-import-gpg) GitHub Action along with this one:
+If [signing is enabled](https://goreleaser.com/customization/#Signing) in your GoReleaser configuration, you can use
+the [Import GPG](https://github.com/crazy-max/ghaction-import-gpg) GitHub Action along with this one:
 
 ```yaml
       -
         name: Import GPG key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v3
+        uses: crazy-max/ghaction-import-gpg@v7
         with:
-          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.PASSPHRASE }}
       -
         name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v7
         with:
-          version: latest
-          args: release --rm-dist
+          version: '~> v2'
+          args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
@@ -126,23 +184,24 @@ signs:
 ### Upload artifacts
 
 For some events like pull request or schedule you might want to store the artifacts somewhere for testing
-purpose. You can do that with the [actions/upload-artifact](https://github.com/actions/upload-artifact) action:
+purposes. You can do that with the [actions/upload-artifact](https://github.com/actions/upload-artifact) action:
 
 ```yaml
       -
         name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v7
         with:
-          version: latest
-          args: release --rm-dist
+          version: '~> v2'
+          args: release --clean
+          workdir: myfolder
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Upload assets
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v6
         with:
           name: myapp
-          path: dist/*
+          path: myfolder/dist/*
 ```
 
 ### Install Only
@@ -151,7 +210,7 @@ purpose. You can do that with the [actions/upload-artifact](https://github.com/a
 steps:
   -
     name: Install GoReleaser
-    uses: goreleaser/goreleaser-action@v2
+    uses: goreleaser/goreleaser-action@v7
     with:
       install-only: true
   -
@@ -159,60 +218,124 @@ steps:
     run: goreleaser -v
 ```
 
+### Cache the binary
+
+The action always looks for GoReleaser in the [runner tool cache][toolcache]
+first. That cache is kept between jobs on self-hosted runners only, so on
+GitHub-hosted runners every job downloads and verifies the release again.
+
+Set `cache-binary` to store the binary in the [GitHub Actions cache][ghcache]
+as well. Later jobs then restore it instead of downloading the release archive,
+the checksums and the signature bundle again:
+
+```yaml
+steps:
+  -
+    name: Install GoReleaser
+    uses: goreleaser/goreleaser-action@v7
+    with:
+      version: '~> v2'
+      install-only: true
+      cache-binary: true
+```
+
+The cache entry is written per distribution, version, operating system and
+architecture, and it counts against the [cache size limit][ghcachelimit] of your
+repository. Cache errors are not fatal: the action logs a warning and falls back
+to a download.
+
+[toolcache]: https://github.com/actions/toolkit/tree/main/packages/tool-cache
+[ghcache]: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/cache-dependencies
+[ghcachelimit]: https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#usage-limits-and-eviction-policy
+
 ## Customizing
 
 ### inputs
 
 Following inputs can be used as `step.with` keys
 
-| Name             | Type    | Default   | Description                               |
-|------------------|---------|-----------|-------------------------------------------|
-| `version`**¹**   | String  | `latest`  | GoReleaser version                        |
-| `args`           | String  |           | Arguments to pass to GoReleaser           |
-| `workdir`        | String  | `.`       | Working directory (below repository root) |
-| `install-only`   | Bool    | `false`   | Just install GoReleaser                   |
+| Name             | Type    | Default      | Description                                                      |
+|------------------|---------|--------------|------------------------------------------------------------------|
+| `distribution`   | String  | `goreleaser` | GoReleaser distribution, either `goreleaser` or `goreleaser-pro` |
+| `version`**¹**   | String  | `~> v2`      | GoReleaser version                                               |
+| `version-file`**²** | String  |              | Read the GoReleaser version from a file (see below)              |
+| `args`           | String  |              | Arguments to pass to GoReleaser                                  |
+| `workdir`        | String  | `.`          | Working directory (below repository root)                        |
+| `install-only`   | Bool    | `false`      | Just install GoReleaser                                          |
+| `cache-binary`   | Bool    | `false`      | Cache the GoReleaser binary in the GitHub Actions cache (see below) |
 
 > **¹** Can be a fixed version like `v0.117.0` or a max satisfying semver one like `~> 0.132`. In this case this will return `v0.132.1`.
+>
+> **²** Path to a file containing the GoReleaser version. Resolved relative
+> to `workdir`. Currently only [`.tool-versions`](https://asdf-vm.com/manage/configuration.html#tool-versions)
+> (asdf/mise) format is supported. When set, this takes precedence over `version`.
+>
+> ```yaml
+> # .tool-versions
+> goreleaser 2.13.0
+> ```
+>
+> ```yaml
+> - uses: goreleaser/goreleaser-action@v7
+>   with:
+>     version-file: .tool-versions
+>     args: release --clean
+> ```
+
+### outputs
+
+Following outputs are available
+
+| Name        | Type | Description            |
+|-------------|------|------------------------|
+| `artifacts` | JSON | Build result artifacts |
+| `metadata`  | JSON | Build result metadata  |
 
 ### environment variables
 
 Following environment variables can be used as `step.env` keys
 
-| Name           | Description                           |
-|----------------|---------------------------------------|
-| `GITHUB_TOKEN` | [GITHUB_TOKEN](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token) as provided by `secrets` |
+| Name             | Description                                                                                                                                         |
+|------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|
+| `GITHUB_TOKEN`   | [GITHUB_TOKEN](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token) as provided by `secrets` and requires `contents:write` |
+| `GORELEASER_KEY` | Your [GoReleaser Pro](https://goreleaser.com/pro) License Key, in case you are using the `goreleaser-pro` distribution                              |
 
 ## Limitation
 
 `GITHUB_TOKEN` permissions [are limited to the repository](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token#about-the-github_token-secret)
-that contains your workflow. 
+that contains your workflow.
 
 If you need to push the homebrew tap to another repository, you must therefore create a custom [Personal Access Token](https://help.github.com/articles/creating-a-personal-access-token-for-the-command-line/)
-with `repo` permissions and [add it as a secret in the repository](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets). If you create a 
+with `repo` permissions and [add it as a secret in the repository](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets). If you create a
 secret named `GH_PAT`, the step will look like this:
 
 ```yaml
       -
         name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@v7
         with:
-          version: latest
-          args: release --rm-dist
+          version: '~> v2'
+          args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GH_PAT }}
 ```
 
+## Migrating from v3
+
+If you need the auto-snapshot feature, take a look at [this example repository](https://github.com/caarlos0/goreleaser-action-v4-auto-snapshot-example): it's a minimal working example with all you need.
+
 ## Development
 
+See [CONTRIBUTING.md](./CONTRIBUTING.md) for the full development workflow.
+
+Quick reference:
+
 ```
-# format code and build javascript artifacts
-docker buildx bake pre-checkin
+# install dependencies
+npm ci
 
-# validate all code has correctly formatted and built
-docker buildx bake validate
-
-# run tests
-docker buildx bake test
+# format, build dist/, and run tests
+npm run pre-checkin
 ```
 
 ## License

__tests__/git.test.ts

@@ -1,30 +0,0 @@
-import * as git from '../src/git';
-
-describe('git', () => {
-  it('returns git tag through describe', async () => {
-    process.env.GITHUB_SHA = '309312125ed7a32fcd48f3a1e24dcafe669c186a';
-    const tag: string = await git.getTag();
-    console.log(`tag: ${tag}`);
-    expect(tag).not.toEqual('');
-  });
-  it('returns git tag through GITHUB_SHA', async () => {
-    process.env.GITHUB_SHA = '6e37040623d14330555c7be1603a9182cf92d32a';
-    const tag: string = await git.getTag();
-    console.log(`tag: ${tag}`);
-    expect(tag).toEqual('v1');
-  });
-  it('returns git tag through GITHUB_REF', async () => {
-    process.env.GITHUB_REF = 'refs/tags/v2.2.1';
-    const tag: string = await git.getTag();
-    console.log(`tag: ${tag}`);
-    expect(tag).toEqual('v2.2.1');
-  });
-  it('checks if tag is dirty', async () => {
-    expect(await git.isTagDirty('v1.3.1')).toBe(true);
-  });
-  it('returns short commit', async () => {
-    const commit: string = await git.getShortCommit();
-    console.log(`commit: ${commit}`);
-    expect(commit).not.toEqual('');
-  });
-});

__tests__/github.test.ts

@@ -1,20 +1,119 @@
+import {describe, expect, it} from '@jest/globals';
 import * as github from '../src/github';
 
-describe('github', () => {
+describe('getRelease', () => {
   it('returns latest GoReleaser GitHub release', async () => {
-    const release = await github.getRelease('latest');
+    const release = await github.getRelease('goreleaser', 'latest');
     expect(release).not.toBeNull();
     expect(release?.tag_name).not.toEqual('');
-    console.log(`tag_name: ${release?.tag_name}`);
   });
-  it('returns v0.117.0 GoReleaser GitHub release', async () => {
-    const release = await github.getRelease('v0.117.0');
+
+  it('returns v0.182.0 GoReleaser GitHub release', async () => {
+    const release = await github.getRelease('goreleaser', 'v0.182.0');
     expect(release).not.toBeNull();
-    expect(release?.tag_name).toEqual('v0.117.0');
+    expect(release?.tag_name).toEqual('v0.182.0');
   });
-  it('returns v0.132.1 GoReleaser GitHub release', async () => {
-    const release = await github.getRelease('~> 0.132');
+
+  it('returns v0.182.1 GoReleaser GitHub release', async () => {
+    const release = await github.getRelease('goreleaser', '~> 0.182');
     expect(release).not.toBeNull();
-    expect(release?.tag_name).toEqual('v0.132.1');
+    expect(release?.tag_name).toEqual('v0.182.1');
+  });
+
+  it('unknown GoReleaser release', async () => {
+    await expect(github.getRelease('goreleaser', 'foo')).rejects.toThrow(
+      new Error('Cannot find GoReleaser release foo in https://goreleaser.com/releases.json')
+    );
+  });
+
+  it('returns latest GoReleaser Pro GitHub release', async () => {
+    const release = await github.getRelease('goreleaser-pro', 'latest');
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+
+  it('returns latest v1 GoReleaser Pro GitHub release', async () => {
+    const release = await github.getRelease('goreleaser-pro', '~> v1');
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+
+  it('returns latest v1 GoReleaser GitHub release', async () => {
+    const release = await github.getRelease('goreleaser', '~> v1');
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+
+  it('returns latest v2 GoReleaser Pro GitHub release', async () => {
+    const release = await github.getRelease('goreleaser-pro', '~> v2');
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+
+  it('returns latest v2 GoReleaser GitHub release', async () => {
+    const release = await github.getRelease('goreleaser', '~> v2');
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+
+  it('resolves nightly to a <version>-<sha>-nightly release for OSS GoReleaser', async () => {
+    const release = await github.getRelease('goreleaser', 'nightly');
+    expect(release).not.toBeNull();
+    expect(release.tag_name).toMatch(github.nightlyTagRegex);
+  });
+
+  it('resolves nightly to a <version>-<sha>-nightly release for GoReleaser Pro', async () => {
+    const release = await github.getRelease('goreleaser-pro', 'nightly');
+    expect(release).not.toBeNull();
+    expect(release.tag_name).toMatch(github.nightlyTagRegex);
+  });
+
+  it('returns v0.182.0 GoReleaser Pro GitHub release', async () => {
+    const release = await github.getRelease('goreleaser-pro', 'v0.182.0');
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).toEqual('v0.182.0-pro');
+  });
+
+  it('returns v0.182.1 GoReleaser Pro GitHub release', async () => {
+    const release = await github.getRelease('goreleaser-pro', '~> 0.182');
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).toEqual('v0.182.1-pro');
+  });
+
+  it('returns v2.7.0 GoReleaser Pro GitHub release', async () => {
+    const release = await github.getRelease('goreleaser-pro', '~> v2.7');
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).toEqual('v2.7.0');
+  });
+
+  it('skips JSON check for specific version v2.8.1', async () => {
+    const release = await github.getRelease('goreleaser', 'v2.8.1');
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).toEqual('v2.8.1');
+  });
+
+  it('skips JSON check for specific version without v prefix', async () => {
+    const release = await github.getRelease('goreleaser', '2.8.1');
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).toEqual('v2.8.1');
+  });
+
+  it('unknown GoReleaser Pro release', async () => {
+    await expect(github.getRelease('goreleaser-pro', 'foo')).rejects.toThrow(
+      new Error('Cannot find GoReleaser release foo in https://goreleaser.com/releases-pro.json')
+    );
+  });
+});
+
+describe('latestNightlyRelease', () => {
+  it('returns the newest nightly by published_at even when API order is wrong', () => {
+    const release = github.latestNightlyRelease([
+      {tag_name: 'v2.16.0-c9b458fa-nightly', published_at: '2026-05-12T01:27:50Z'},
+      {tag_name: 'v2.16.0-6724de64-nightly', published_at: '2026-05-13T01:32:53Z'},
+      {tag_name: 'v2.16.0-2827930b-nightly', published_at: '2026-05-17T01:34:11Z'},
+      {tag_name: 'v2.15.4', published_at: '2026-04-21T14:07:57Z'}
+    ]);
+
+    expect(release?.tag_name).toEqual('v2.16.0-2827930b-nightly');
   });
 });

__tests__/goreleaser.test.ts

@@ -0,0 +1,181 @@
+import {describe, expect, it} from '@jest/globals';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import * as io from '@actions/io';
+import * as goreleaser from '../src/goreleaser';
+
+describe('install', () => {
+  it('acquires latest version of GoReleaser', async () => {
+    const bin = await goreleaser.install('goreleaser', 'latest');
+    expect(fs.existsSync(bin)).toBe(true);
+  }, 100000);
+
+  it('acquires latest v2 version of GoReleaser', async () => {
+    const bin = await goreleaser.install('goreleaser', '~> v2');
+    expect(fs.existsSync(bin)).toBe(true);
+  }, 100000);
+
+  // The following pinned versions exercise install across release eras to
+  // guard against regressions in checksum handling and the cosign skip path:
+  //   - v0.182.0  : pre-checksums-signing era
+  //   - v1.26.2   : cosign v2 detached `.sig` only
+  //   - v2.12.4   : last release before sigstore bundles (cosign skipped)
+  //   - v2.13.0   : first release with cosign v3 sigstore bundle
+  //   - v2.15.3   : recent release with sigstore bundle
+  it('acquires v0.182.0 (pre-signing) version of GoReleaser', async () => {
+    const bin = await goreleaser.install('goreleaser', 'v0.182.0');
+    expect(fs.existsSync(bin)).toBe(true);
+  }, 100000);
+
+  it('acquires v1.26.2 (cosign v2 .sig) version of GoReleaser', async () => {
+    const bin = await goreleaser.install('goreleaser', 'v1.26.2');
+    expect(fs.existsSync(bin)).toBe(true);
+  }, 100000);
+
+  it('acquires v2.12.4 (last pre-sigstore-bundle) version of GoReleaser', async () => {
+    const bin = await goreleaser.install('goreleaser', 'v2.12.4');
+    expect(fs.existsSync(bin)).toBe(true);
+  }, 100000);
+
+  it('acquires v2.13.0 (minimum cosign-verifiable) version of GoReleaser', async () => {
+    const bin = await goreleaser.install('goreleaser', 'v2.13.0');
+    expect(fs.existsSync(bin)).toBe(true);
+  }, 100000);
+
+  it('acquires v2.15.3 (recent sigstore-bundle) version of GoReleaser', async () => {
+    const bin = await goreleaser.install('goreleaser', 'v2.15.3');
+    expect(fs.existsSync(bin)).toBe(true);
+  }, 100000);
+
+  it('acquires latest v2 version of GoReleaser Pro', async () => {
+    const bin = await goreleaser.install('goreleaser-pro', '~> v2');
+    expect(fs.existsSync(bin)).toBe(true);
+  }, 100000);
+
+  it('acquires latest version of GoReleaser Pro', async () => {
+    const bin = await goreleaser.install('goreleaser-pro', 'latest');
+    expect(fs.existsSync(bin)).toBe(true);
+  }, 100000);
+
+  it('reuses the runner tool cache on a second install', async () => {
+    const first = await goreleaser.install('goreleaser', 'v2.15.3');
+    const second = await goreleaser.install('goreleaser', 'v2.15.3');
+    expect(second).toEqual(first);
+    expect(fs.existsSync(second)).toBe(true);
+  }, 100000);
+
+  it('does not share the tool cache between distributions', async () => {
+    const oss = await goreleaser.install('goreleaser', 'v2.15.3');
+    const pro = await goreleaser.install('goreleaser-pro', 'v2.15.3');
+    expect(pro).not.toEqual(oss);
+    expect(fs.existsSync(pro)).toBe(true);
+  }, 100000);
+});
+
+describe('distribSuffix', () => {
+  it('suffixes pro distribution', async () => {
+    expect(goreleaser.distribSuffix('goreleaser-pro')).toEqual('-pro');
+  });
+
+  it('does not suffix oss distribution', async () => {
+    expect(goreleaser.distribSuffix('goreleaser')).toEqual('');
+  });
+});
+
+describe('findChecksum', () => {
+  const sample = [
+    '*malformed-line',
+    '',
+    'abc123  goreleaser_Linux_x86_64.tar.gz',
+    'def456 *goreleaser_Darwin_all.tar.gz',
+    '789xyz  checksums.txt'
+  ].join('\n');
+
+  it('finds a checksum by filename', () => {
+    expect(goreleaser.findChecksum(sample, 'goreleaser_Linux_x86_64.tar.gz')).toEqual('abc123');
+  });
+
+  it('strips a leading asterisk on the filename (binary mode)', () => {
+    expect(goreleaser.findChecksum(sample, 'goreleaser_Darwin_all.tar.gz')).toEqual('def456');
+  });
+
+  it('returns undefined when not present', () => {
+    expect(goreleaser.findChecksum(sample, 'missing.tar.gz')).toBeUndefined();
+  });
+});
+
+describe('getCertificateIdentity', () => {
+  it('returns the OSS workflow identity for tagged releases', () => {
+    expect(goreleaser.getCertificateIdentity('goreleaser', 'v2.15.3')).toEqual(
+      'https://github.com/goreleaser/goreleaser/.github/workflows/release.yml@refs/tags/v2.15.3'
+    );
+  });
+
+  it('returns the Pro internal workflow identity for tagged releases', () => {
+    expect(goreleaser.getCertificateIdentity('goreleaser-pro', 'v2.15.3')).toEqual(
+      'https://github.com/goreleaser/goreleaser-pro-internal/.github/workflows/release-pro.yml@refs/tags/v2.15.3'
+    );
+  });
+
+  it('uses nightly-oss.yml@refs/heads/main for OSS nightly tag', () => {
+    expect(goreleaser.getCertificateIdentity('goreleaser', 'v2.16.0-abc1234-nightly')).toEqual(
+      'https://github.com/goreleaser/goreleaser/.github/workflows/nightly-oss.yml@refs/heads/main'
+    );
+  });
+
+  it('uses nightly-pro.yml@refs/heads/main for Pro nightly tag', () => {
+    expect(goreleaser.getCertificateIdentity('goreleaser-pro', 'v2.16.0-eaeb08c50-nightly')).toEqual(
+      'https://github.com/goreleaser/goreleaser-pro-internal/.github/workflows/nightly-pro.yml@refs/heads/main'
+    );
+  });
+});
+
+describe('verifyChecksum', () => {
+  const requireCosign = async (): Promise<void> => {
+    const cosign = await io.which('cosign', false);
+    if (!cosign) {
+      throw new Error(
+        'cosign must be installed in PATH to run this integration test (apk add cosign / sigstore/cosign-installer)'
+      );
+    }
+  };
+
+  it('verifies a tagged OSS release end-to-end with cosign', async () => {
+    await requireCosign();
+    const bin = await goreleaser.install('goreleaser', 'v2.15.3');
+    expect(fs.existsSync(bin)).toBe(true);
+  }, 120000);
+
+  it('verifies the OSS nightly release end-to-end with cosign', async () => {
+    await requireCosign();
+    const bin = await goreleaser.install('goreleaser', 'nightly');
+    expect(fs.existsSync(bin)).toBe(true);
+  }, 120000);
+
+  it('installs a pre-v2.13 release (no sigstore bundle) without failing when cosign is present', async () => {
+    // v2.12.x is the last release that did NOT publish checksums.txt.sigstore.json.
+    // The action must still install it cleanly: checksum verified, cosign step skipped.
+    await requireCosign();
+    const bin = await goreleaser.install('goreleaser', 'v2.12.4');
+    expect(fs.existsSync(bin)).toBe(true);
+  }, 120000);
+
+  it('throws on checksum mismatch', async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gha-'));
+    const archive = path.join(dir, 'fake.tar.gz');
+    fs.writeFileSync(archive, 'tampered content');
+    await expect(
+      goreleaser.verifyChecksum('goreleaser', 'v2.15.3', archive, 'goreleaser_Linux_x86_64.tar.gz')
+    ).rejects.toThrow(/Checksum mismatch/);
+  }, 60000);
+
+  it('throws when the filename is not in checksums.txt', async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gha-'));
+    const archive = path.join(dir, 'whatever.tar.gz');
+    fs.writeFileSync(archive, '');
+    await expect(
+      goreleaser.verifyChecksum('goreleaser', 'v2.15.3', archive, 'not-a-real-asset.tar.gz')
+    ).rejects.toThrow(/Could not find not-a-real-asset.tar.gz in checksums.txt/);
+  }, 60000);
+});

__tests__/installer.test.ts

@@ -1,14 +0,0 @@
-import fs = require('fs');
-import * as installer from '../src/installer';
-
-describe('installer', () => {
-  it('acquires v0.117.0 version of GoReleaser', async () => {
-    const goreleaser = await installer.getGoReleaser('v0.117.0');
-    expect(fs.existsSync(goreleaser)).toBe(true);
-  }, 100000);
-
-  it('acquires latest version of GoReleaser', async () => {
-    const goreleaser = await installer.getGoReleaser('latest');
-    expect(fs.existsSync(goreleaser)).toBe(true);
-  }, 100000);
-});

__tests__/version.test.ts

@@ -0,0 +1,118 @@
+import {describe, expect, it, beforeEach, afterEach} from '@jest/globals';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import {getRequestedVersion} from '../src/version';
+import {Inputs} from '../src/context';
+
+const baseInputs = (overrides: Partial<Inputs>): Inputs => ({
+  distribution: 'goreleaser',
+  version: '~> v2',
+  versionFile: '',
+  args: '',
+  workdir: '.',
+  installOnly: false,
+  cacheBinary: false,
+  ...overrides
+});
+
+describe('getRequestedVersion', () => {
+  let tmpDir: string;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'goreleaser-version-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, {recursive: true, force: true});
+  });
+
+  const writeToolVersions = (content: string, name = '.tool-versions'): void => {
+    fs.writeFileSync(path.join(tmpDir, name), content);
+  };
+
+  describe('without version-file', () => {
+    it('returns the version input as-is', () => {
+      expect(getRequestedVersion(baseInputs({version: 'v1.2.3'}))).toBe('v1.2.3');
+    });
+
+    it('returns the default version when none is provided', () => {
+      expect(getRequestedVersion(baseInputs({version: '~> v2'}))).toBe('~> v2');
+    });
+  });
+
+  describe('with .tool-versions', () => {
+    it('parses an unprefixed version and adds the v prefix', () => {
+      writeToolVersions('goreleaser 1.2.3\n');
+      expect(getRequestedVersion(baseInputs({versionFile: '.tool-versions', workdir: tmpDir}))).toBe('v1.2.3');
+    });
+
+    it('keeps an existing v prefix without doubling it', () => {
+      writeToolVersions('goreleaser v1.2.3\n');
+      expect(getRequestedVersion(baseInputs({versionFile: '.tool-versions', workdir: tmpDir}))).toBe('v1.2.3');
+    });
+
+    it('takes precedence over the version input', () => {
+      writeToolVersions('goreleaser 1.2.3\n');
+      expect(getRequestedVersion(baseInputs({version: 'v9.9.9', versionFile: '.tool-versions', workdir: tmpDir}))).toBe(
+        'v1.2.3'
+      );
+    });
+
+    it('ignores other tools and picks goreleaser', () => {
+      writeToolVersions(['nodejs 20.10.0', 'goreleaser 2.13.0', 'python 3.12.1', ''].join('\n'));
+      expect(getRequestedVersion(baseInputs({versionFile: '.tool-versions', workdir: tmpDir}))).toBe('v2.13.0');
+    });
+
+    it('skips full-line and inline comments', () => {
+      writeToolVersions(['# pinned for CI', 'goreleaser 2.13.0 # minimum cosign-verifiable', ''].join('\n'));
+      expect(getRequestedVersion(baseInputs({versionFile: '.tool-versions', workdir: tmpDir}))).toBe('v2.13.0');
+    });
+
+    it('preserves "latest"', () => {
+      writeToolVersions('goreleaser latest\n');
+      expect(getRequestedVersion(baseInputs({versionFile: '.tool-versions', workdir: tmpDir}))).toBe('latest');
+    });
+
+    it('uses only the first version when multiple fallbacks are listed', () => {
+      // asdf supports listing fallback versions; we install the first match.
+      writeToolVersions('goreleaser 2.13.0 2.12.4\n');
+      expect(getRequestedVersion(baseInputs({versionFile: '.tool-versions', workdir: tmpDir}))).toBe('v2.13.0');
+    });
+
+    it('accepts an absolute path and ignores workdir', () => {
+      const abs = path.join(tmpDir, '.tool-versions');
+      fs.writeFileSync(abs, 'goreleaser 2.13.0\n');
+      expect(getRequestedVersion(baseInputs({versionFile: abs, workdir: '/nonexistent'}))).toBe('v2.13.0');
+    });
+
+    it('throws when the file does not exist', () => {
+      expect(() => getRequestedVersion(baseInputs({versionFile: '.tool-versions', workdir: tmpDir}))).toThrow(
+        /version-file not found/
+      );
+    });
+
+    it('throws when the file has no goreleaser entry', () => {
+      writeToolVersions(['nodejs 20.10.0', 'python 3.12.1', ''].join('\n'));
+      expect(() => getRequestedVersion(baseInputs({versionFile: '.tool-versions', workdir: tmpDir}))).toThrow(
+        /No goreleaser entry/
+      );
+    });
+
+    it('throws when the goreleaser entry has no version', () => {
+      writeToolVersions('goreleaser\n');
+      expect(() => getRequestedVersion(baseInputs({versionFile: '.tool-versions', workdir: tmpDir}))).toThrow(
+        /No version specified for goreleaser/
+      );
+    });
+  });
+
+  describe('with an unsupported file', () => {
+    it('throws a clear error', () => {
+      fs.writeFileSync(path.join(tmpDir, '.go-version'), '1.2.3\n');
+      expect(() => getRequestedVersion(baseInputs({versionFile: '.go-version', workdir: tmpDir}))).toThrow(
+        /Unsupported version-file/
+      );
+    });
+  });
+});

action.yml

@@ -1,15 +1,25 @@
 # https://help.github.com/en/articles/metadata-syntax-for-github-actions
 name: 'GoReleaser Action'
 description: 'GitHub Action for GoReleaser, a release automation tool for Go projects'
-author: 'crazy-max'
+author: 'goreleaser'
 branding:
   color: 'green'
   icon: 'package'
 
 inputs:
+  distribution:
+    description: 'GoReleaser Distribution (goreleaser or goreleaser-pro)'
+    default: 'goreleaser'
+    required: false
   version:
     description: 'GoReleaser version'
-    default: 'latest'
+    default: '~> v2'
+    required: false
+  version-file:
+    description: |
+      Read the GoReleaser version from a file. Path is resolved relative to
+      `workdir`. Currently only `.tool-versions` (asdf/mise) is supported.
+      When set, takes precedence over `version`.
     required: false
   args:
     description: 'Arguments to pass to GoReleaser'
@@ -22,7 +32,17 @@ inputs:
     description: 'Just install GoReleaser'
     default: 'false'
     required: false
+  cache-binary:
+    description: 'Cache the GoReleaser binary in the GitHub Actions cache'
+    default: 'false'
+    required: false
+
+outputs:
+  artifacts:
+    description: 'Build result artifacts'
+  metadata:
+    description: 'Build result metadata'
 
 runs:
-  using: 'node12'
+  using: 'node24'
   main: 'dist/index.js'

dist/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

docker-bake.hcl

@@ -1,67 +0,0 @@
-variable "NODE_VERSION" {
-  default = "12"
-}
-
-target "node-version" {
-  args = {
-    NODE_VERSION = NODE_VERSION
-  }
-}
-
-group "default" {
-  targets = ["build"]
-}
-
-group "pre-checkin" {
-  targets = ["vendor-update", "format", "build"]
-}
-
-group "validate" {
-  targets = ["format-validate", "build-validate", "vendor-validate"]
-}
-
-target "build" {
-  inherits = ["node-version"]
-  dockerfile = "./hack/build.Dockerfile"
-  target = "build-update"
-  output = ["."]
-}
-
-target "build-validate" {
-  inherits = ["node-version"]
-  dockerfile = "./hack/build.Dockerfile"
-  target = "build-validate"
-}
-
-target "format" {
-  inherits = ["node-version"]
-  dockerfile = "./hack/build.Dockerfile"
-  target = "format-update"
-  output = ["."]
-}
-
-target "format-validate" {
-  inherits = ["node-version"]
-  dockerfile = "./hack/build.Dockerfile"
-  target = "format-validate"
-}
-
-target "vendor-update" {
-  inherits = ["node-version"]
-  dockerfile = "./hack/vendor.Dockerfile"
-  target = "update"
-  output = ["."]
-}
-
-target "vendor-validate" {
-  inherits = ["node-version"]
-  dockerfile = "./hack/vendor.Dockerfile"
-  target = "validate"
-}
-
-target "test" {
-  inherits = ["node-version"]
-  dockerfile = "./hack/test.Dockerfile"
-  target = "test-coverage"
-  output = ["./coverage"]
-}

hack/build.Dockerfile

@@ -1,42 +0,0 @@
-# syntax=docker/dockerfile:1.2
-ARG NODE_VERSION
-
-FROM node:${NODE_VERSION}-alpine AS base
-RUN apk add --no-cache cpio findutils git
-WORKDIR /src
-
-FROM base AS deps
-RUN --mount=type=bind,target=.,rw \
-  --mount=type=cache,target=/src/node_modules \
-  yarn install
-
-FROM deps AS build
-RUN --mount=type=bind,target=.,rw \
-  --mount=type=cache,target=/src/node_modules \
-  yarn run build && mkdir /out && cp -Rf dist /out/
-
-FROM scratch AS build-update
-COPY --from=build /out /
-
-FROM build AS build-validate
-RUN --mount=type=bind,target=.,rw \
-  git add -A && cp -rf /out/* .; \
-  if [ -n "$(git status --porcelain -- dist)" ]; then \
-    echo >&2 'ERROR: Build result differs. Please build first with "docker buildx bake build"'; \
-    git status --porcelain -- dist; \
-    exit 1; \
-  fi
-
-FROM deps AS format
-RUN --mount=type=bind,target=.,rw \
-  --mount=type=cache,target=/src/node_modules \
-  yarn run format \
-  && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' | cpio -pdm /out
-
-FROM scratch AS format-update
-COPY --from=format /out /
-
-FROM deps AS format-validate
-RUN --mount=type=bind,target=.,rw \
-  --mount=type=cache,target=/src/node_modules \
-  yarn run format-check \

hack/test.Dockerfile

@@ -1,21 +0,0 @@
-# syntax=docker/dockerfile:1.2
-ARG NODE_VERSION
-
-FROM node:${NODE_VERSION}-alpine AS base
-RUN apk add --no-cache git
-WORKDIR /src
-
-FROM base AS deps
-RUN --mount=type=bind,target=.,rw \
-  --mount=type=cache,target=/src/node_modules \
-  yarn install
-
-FROM deps AS test
-ENV RUNNER_TEMP=/tmp/github_runner
-ENV RUNNER_TOOL_CACHE=/tmp/github_tool_cache
-RUN --mount=type=bind,target=.,rw \
-  --mount=type=cache,target=/src/node_modules \
-  yarn run test --coverageDirectory=/tmp/coverage
-
-FROM scratch AS test-coverage
-COPY --from=test /tmp/coverage /

hack/vendor.Dockerfile

@@ -1,23 +0,0 @@
-# syntax=docker/dockerfile:1.2
-ARG NODE_VERSION
-
-FROM node:${NODE_VERSION}-alpine AS base
-RUN apk add --no-cache git
-WORKDIR /src
-
-FROM base AS vendored
-RUN --mount=type=bind,target=.,rw \
-  --mount=type=cache,target=/src/node_modules \
-  yarn install && mkdir /out && cp yarn.lock /out
-
-FROM scratch AS update
-COPY --from=vendored /out /
-
-FROM vendored AS validate
-RUN --mount=type=bind,target=.,rw \
-  git add -A && cp -rf /out/* .; \
-  if [ -n "$(git status --porcelain -- yarn.lock)" ]; then \
-    echo >&2 'ERROR: Vendor result differs. Please vendor your package with "docker buildx bake vendor-update"'; \
-    git status --porcelain -- yarn.lock; \
-    exit 1; \
-  fi

jest.config.js

@@ -1,16 +0,0 @@
-module.exports = {
-  clearMocks: true,
-  moduleFileExtensions: ['js', 'ts'],
-  setupFiles: [
-    "dotenv/config",
-    "<rootDir>/src/test_setup.ts"
-  ],
-  testEnvironment: 'node',
-  testMatch: ['**/*.test.ts'],
-  testRunner: 'jest-circus/runner',
-  testTimeout: 30000,
-  transform: {
-    '^.+\\.ts$': 'ts-jest'
-  },
-  verbose: false
-}

jest.config.ts

@@ -0,0 +1,24 @@
+import type {Config} from 'jest';
+
+const config: Config = {
+  clearMocks: true,
+  moduleFileExtensions: ['js', 'ts'],
+  setupFiles: ['dotenv/config', '<rootDir>/src/test_setup.ts'],
+  testMatch: ['**/*.test.ts'],
+  testTimeout: 30000,
+  transform: {
+    '^.+\\.ts$': [
+      'ts-jest',
+      {
+        useESM: true
+      }
+    ]
+  },
+  extensionsToTreatAsEsm: ['.ts'],
+  moduleNameMapper: {
+    '^(\\.{1,2}/.*)\\.js$': '$1'
+  },
+  verbose: true
+};
+
+export default config;

package.json

@@ -1,13 +1,16 @@
 {
   "name": "goreleaser-action",
   "description": "GitHub Action for GoReleaser, a release automation tool for Go projects",
-  "main": "lib/main.js",
+  "main": "src/main.ts",
+  "type": "module",
   "scripts": {
-    "build": "tsc && ncc build",
-    "test": "jest --coverage",
-    "format": "prettier --write **/*.ts",
-    "format-check": "prettier --check **/*.ts",
-    "pre-checkin": "yarn run format && yarn run build"
+    "build": "ncc build src/main.ts --minify --license licenses.txt",
+    "format": "prettier --write \"**/*.ts\"",
+    "format-check": "prettier --check \"**/*.ts\"",
+    "lint": "eslint --max-warnings=0 \"**/*.ts\"",
+    "lint:fix": "eslint --fix \"**/*.ts\"",
+    "test": "NODE_OPTIONS='--experimental-vm-modules' jest --coverage",
+    "pre-checkin": "npm run format && npm run lint:fix && npm run build && npm test"
   },
   "repository": {
     "type": "git",
@@ -21,23 +24,30 @@
   "author": "CrazyMax",
   "license": "MIT",
   "dependencies": {
-    "@actions/core": "^1.2.6",
-    "@actions/exec": "^1.0.4",
-    "@actions/http-client": "^1.0.11",
-    "@actions/tool-cache": "^1.6.1"
+    "@actions/cache": "^6.2.0",
+    "@actions/core": "^3.0.1",
+    "@actions/exec": "^3.0.0",
+    "@actions/http-client": "^4.0.1",
+    "@actions/tool-cache": "^4.0.0",
+    "js-yaml": "^5.2.3",
+    "semver": "^7.8.5",
+    "yargs": "^18.1.0"
   },
   "devDependencies": {
-    "@types/jest": "^26.0.14",
-    "@types/node": "^14.11.2",
-    "@vercel/ncc": "^0.24.1",
-    "dotenv": "^8.2.0",
-    "jest": "^26.4.2",
-    "jest-circus": "^26.4.2",
-    "jest-runtime": "^26.4.2",
-    "prettier": "^2.1.2",
+    "@types/node": "^24.0.0",
+    "@typescript-eslint/eslint-plugin": "^6.6.0",
+    "@typescript-eslint/parser": "^6.6.0",
+    "@vercel/ncc": "^0.38.0",
+    "dotenv": "^16.3.1",
+    "eslint": "^8.49.0",
+    "eslint-config-prettier": "^9.0.0",
+    "eslint-plugin-jest": "^27.2.3",
+    "eslint-plugin-prettier": "^5.0.0",
+    "jest": "^29.6.4",
+    "prettier": "^3.0.3",
     "tmp": "^0.2.1",
-    "ts-jest": "^26.4.1",
-    "typescript": "^4.0.3",
-    "typescript-formatter": "^7.2.2"
+    "ts-jest": "^29.1.1",
+    "ts-node": "^10.9.1",
+    "typescript": "^5.2.2"
   }
 }

src/context.ts

@@ -0,0 +1,27 @@
+import * as os from 'os';
+import * as core from '@actions/core';
+
+export const osPlat: string = os.platform();
+export const osArch: string = os.arch();
+
+export interface Inputs {
+  distribution: string;
+  version: string;
+  versionFile: string;
+  args: string;
+  workdir: string;
+  installOnly: boolean;
+  cacheBinary: boolean;
+}
+
+export async function getInputs(): Promise<Inputs> {
+  return {
+    distribution: core.getInput('distribution') || 'goreleaser',
+    version: core.getInput('version') || '~> v2',
+    versionFile: core.getInput('version-file'),
+    args: core.getInput('args'),
+    workdir: core.getInput('workdir') || '.',
+    installOnly: core.getBooleanInput('install-only'),
+    cacheBinary: core.getBooleanInput('cache-binary')
+  };
+}

src/exec.ts

@@ -1,34 +0,0 @@
-import * as actionsExec from '@actions/exec';
-import {ExecOptions} from '@actions/exec';
-
-export interface ExecResult {
-  success: boolean;
-  stdout: string;
-  stderr: string;
-}
-
-export const exec = async (command: string, args: string[] = [], silent: boolean): Promise<ExecResult> => {
-  let stdout: string = '';
-  let stderr: string = '';
-
-  const options: ExecOptions = {
-    silent: silent,
-    ignoreReturnCode: true
-  };
-  options.listeners = {
-    stdout: (data: Buffer) => {
-      stdout += data.toString();
-    },
-    stderr: (data: Buffer) => {
-      stderr += data.toString();
-    }
-  };
-
-  const returnCode: number = await actionsExec.exec(command, args, options);
-
-  return {
-    success: returnCode === 0,
-    stdout: stdout.trim(),
-    stderr: stderr.trim()
-  };
-};

src/git.ts

@@ -1,44 +0,0 @@
-import * as exec from './exec';
-
-const git = async (args: string[] = []): Promise<string> => {
-  return await exec.exec(`git`, args, true).then(res => {
-    if (res.stderr != '' && !res.success) {
-      throw new Error(res.stderr);
-    }
-    return res.stdout.trim();
-  });
-};
-
-export async function getTag(): Promise<string> {
-  try {
-    if ((process.env.GITHUB_REF || '').startsWith('refs/tags')) {
-      const tag = (process.env.GITHUB_REF || '').split('/').pop();
-      if (tag !== '' && tag !== undefined) {
-        return tag;
-      }
-    }
-    return await git(['tag', '--points-at', `${process.env.GITHUB_SHA}`, '--sort', '-version:creatordate']).then(
-      tags => {
-        if (tags.length == 0) {
-          return git(['describe', '--tags', '--abbrev=0']);
-        }
-        return tags.split('\n')[0];
-      }
-    );
-  } catch (err) {
-    return '';
-  }
-}
-
-export async function isTagDirty(currentTag: string): Promise<boolean> {
-  try {
-    await git(['describe', '--exact-match', '--tags', '--match', currentTag]);
-  } catch (err) {
-    return true;
-  }
-  return false;
-}
-
-export async function getShortCommit(): Promise<string> {
-  return await git(['show', "--format='%h'", 'HEAD', '--quiet']);
-}

src/github.ts

@@ -1,43 +1,174 @@
-import * as httpm from '@actions/http-client';
-import * as core from '@actions/core';
+import * as goreleaser from './goreleaser';
 import * as semver from 'semver';
+import * as core from '@actions/core';
+import * as httpm from '@actions/http-client';
 
-export interface GitHubRelease {
-  id: number;
-  tag_name: string;
-}
+const maxRetries = 10;
+const timeoutMs = 1000;
+const withRetry = async <T>(operation: () => Promise<T>): Promise<T> => {
+  let lastError: Error;
 
-export const getRelease = async (version: string): Promise<GitHubRelease | null> => {
-  const resolvedVersion: string = (await resolveVersion(version)) || version;
-  const url: string = `https://github.com/goreleaser/goreleaser/releases/${resolvedVersion}`;
-  const http: httpm.HttpClient = new httpm.HttpClient('goreleaser-action');
-  return (await http.getJson<GitHubRelease>(url)).result;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    try {
+      return await operation();
+    } catch (error) {
+      lastError = error as Error;
+
+      if (attempt === maxRetries) {
+        break;
+      }
+
+      core.debug(`Attempt ${attempt + 1} failed, retrying in ${timeoutMs}: ${lastError.message}`);
+      await new Promise(resolve => setTimeout(resolve, timeoutMs));
+    }
+  }
+
+  throw lastError;
 };
 
-const resolveVersion = async (version: string): Promise<string | null> => {
-  const allTags: Array<string> | null = await getAllTags();
+export interface GitHubRelease {
+  tag_name: string;
+  published_at?: string;
+}
+
+// Matches the new-style nightly release tag pattern: vX.Y.Z-<sha>-nightly
+export const nightlyTagRegex = /^v\d+\.\d+\.\d+-[0-9a-f]+-nightly$/i;
+
+export const isNightlyTag = (tag: string): boolean => {
+  return nightlyTagRegex.test(tag);
+};
+
+export const latestNightlyRelease = (releases: Array<GitHubRelease>): GitHubRelease | undefined => {
+  return releases
+    .filter(r => nightlyTagRegex.test(r.tag_name))
+    .sort((a, b) => (b.published_at || '').localeCompare(a.published_at || ''))
+    .shift();
+};
+
+export const getRelease = async (distribution: string, version: string): Promise<GitHubRelease> => {
+  if (version === 'latest') {
+    core.warning("You are using 'latest' as default version. Will lock to '~> v2'.");
+    return getReleaseTag(distribution, '~> v2');
+  }
+  return getReleaseTag(distribution, version);
+};
+
+export const getReleaseTag = async (distribution: string, version: string): Promise<GitHubRelease> => {
+  if (version === 'nightly') {
+    return resolveNightly(distribution);
+  }
+
+  // If version is a specific version (not a range), skip the JSON check
+  const cleanVersion: string = cleanTag(version);
+  if (semver.valid(cleanVersion)) {
+    let tag = version.startsWith('v') ? version : `v${version}`;
+
+    // Handle GoReleaser Pro suffix for versions < 2.7.0, but only if not already present
+    // TODO: remove all this `-pro` thing at some point.
+    if (goreleaser.isPro(distribution) && semver.lt(cleanVersion, '2.7.0') && !tag.endsWith('-pro')) {
+      tag = tag + goreleaser.distribSuffix(distribution);
+    }
+
+    return {tag_name: tag};
+  }
+
+  const tag: string = (await resolveVersion(distribution, version)) || version;
+  const suffix: string = goreleaser.distribSuffix(distribution);
+  const url = `https://goreleaser.com/releases${suffix}.json`;
+
+  const releases = await withRetry(async () => {
+    const http: httpm.HttpClient = new httpm.HttpClient('goreleaser-action');
+    const resp: httpm.HttpClientResponse = await http.get(url);
+    const body = await resp.readBody();
+    const statusCode = resp.message.statusCode || 500;
+    if (statusCode >= 400) {
+      throw new Error(
+        `Failed to get GoReleaser release ${version} from ${url} with status code ${statusCode}: ${body}`
+      );
+    }
+    return <Array<GitHubRelease>>JSON.parse(body);
+  });
+
+  const res = releases.filter(r => r.tag_name === tag).shift();
+  if (res) {
+    return res;
+  }
+  throw new Error(`Cannot find GoReleaser release ${version} in ${url}`);
+};
+
+// resolveNightly looks up the latest immutable nightly release of the form
+// `vX.Y.Z-<sha>-nightly` on the GitHub releases of the given distribution.
+const resolveNightly = async (distribution: string): Promise<GitHubRelease> => {
+  const url = `https://api.github.com/repos/goreleaser/${distribution}/releases?per_page=100`;
+  core.debug(`Resolving latest nightly release from ${url}`);
+
+  const releases = await withRetry(async () => {
+    const http: httpm.HttpClient = new httpm.HttpClient('goreleaser-action');
+    const headers: {[name: string]: string} = {
+      Accept: 'application/vnd.github+json',
+      'X-GitHub-Api-Version': '2022-11-28'
+    };
+    const token = process.env.GITHUB_TOKEN;
+    if (token) {
+      headers['Authorization'] = `Bearer ${token}`;
+    }
+    const resp: httpm.HttpClientResponse = await http.get(url, headers);
+    const body = await resp.readBody();
+    const statusCode = resp.message.statusCode || 500;
+    if (statusCode >= 400) {
+      throw new Error(`Failed to list releases from ${url} with status code ${statusCode}: ${body}`);
+    }
+    return <Array<GitHubRelease>>JSON.parse(body);
+  });
+
+  const match = latestNightlyRelease(releases);
+  if (!match) {
+    throw new Error(`No '<version>-<sha>-nightly' release found in ${url}`);
+  }
+  core.info(`Resolved nightly to ${match.tag_name}`);
+  return match;
+};
+
+const resolveVersion = async (distribution: string, version: string): Promise<string | null> => {
+  const allTags: Array<string> | null = await getAllTags(distribution);
   if (!allTags) {
-    throw new Error(`Cannot find GoReleaser tags`);
+    throw new Error(`Cannot download ${distribution} tags`);
   }
   core.debug(`Found ${allTags.length} tags in total`);
 
-  return semver.maxSatisfying(allTags, version);
+  const cleanTags: Array<string> = allTags.map(tag => cleanTag(tag));
+  const cleanVersion: string = cleanTag(version);
+  if (!semver.valid(cleanVersion) && !semver.validRange(cleanVersion)) {
+    // if the given version is invalid, return whatever we got.
+    return version;
+  }
+  const v = semver.maxSatisfying(cleanTags, cleanVersion);
+  if (semver.lt(v, '2.7.0')) {
+    // if its a version older than 2.7.0, append the suffix.
+    return v + goreleaser.distribSuffix(distribution);
+  }
+  return v;
 };
 
 interface GitHubTag {
   tag_name: string;
 }
 
-const getAllTags = async (): Promise<Array<string>> => {
-  const http: httpm.HttpClient = new httpm.HttpClient('goreleaser-action');
-  const url: string = `https://goreleaser.com/static/releases.json`;
-  const getTags = http.getJson<Array<GitHubTag>>(url);
+const getAllTags = async (distribution: string): Promise<Array<string>> => {
+  const suffix: string = goreleaser.distribSuffix(distribution);
+  const url = `https://goreleaser.com/releases${suffix}.json`;
+  core.debug(`Downloading ${url}`);
 
-  return getTags.then(response => {
+  return withRetry(async () => {
+    const http: httpm.HttpClient = new httpm.HttpClient('goreleaser-action');
+    const response = await http.getJson<Array<GitHubTag>>(url);
     if (response.result == null) {
       return [];
     }
-
     return response.result.map(obj => obj.tag_name);
   });
 };
+
+const cleanTag = (tag: string): string => {
+  return tag.replace(/-pro$/, '');
+};

src/goreleaser.ts

@@ -0,0 +1,262 @@
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import * as yaml from 'js-yaml';
+import * as context from './context';
+import * as github from './github';
+import * as cache from '@actions/cache';
+import * as core from '@actions/core';
+import * as exec from '@actions/exec';
+import * as io from '@actions/io';
+import * as tc from '@actions/tool-cache';
+
+export async function install(distribution: string, version: string, cacheBinary = false): Promise<string> {
+  const release: github.GitHubRelease = await github.getRelease(distribution, version);
+  const tag = release.tag_name;
+  const toolVersion = tag.replace(/^v/, '');
+
+  const toolPath = tc.find(distribution, toolVersion);
+  if (toolPath) {
+    core.info(`GoReleaser ${tag} found in the runner tool cache: ${toolPath}`);
+    return getExePath(toolPath);
+  }
+
+  const filename = getFilename(distribution);
+  const extPath = path.join(process.env.RUNNER_TEMP || os.tmpdir(), 'goreleaser-action', distribution, toolVersion);
+  const useCache = cacheBinary && cache.isFeatureAvailable();
+  // The GitHub Actions cache is shared by every runner of a repository, so the
+  // key must pin the distribution, platform and architecture. The release
+  // filename already encodes all three.
+  const cacheKey = `goreleaser-action-${tag}-${filename}`;
+
+  if (useCache && (await restoreCache(cacheKey, extPath))) {
+    return getExePath(await tc.cacheDir(extPath, distribution, toolVersion));
+  }
+
+  const baseUrl = `https://github.com/goreleaser/${distribution}/releases/download/${tag}`;
+  const downloadUrl = `${baseUrl}/${filename}`;
+
+  core.info(`Downloading ${downloadUrl}`);
+  const downloadPath: string = await tc.downloadTool(downloadUrl);
+  core.debug(`Downloaded to ${downloadPath}`);
+
+  await verifyChecksum(distribution, tag, downloadPath, filename);
+
+  core.info('Extracting GoReleaser');
+  await io.rmRF(extPath);
+  if (context.osPlat == 'win32') {
+    let zipPath = downloadPath;
+    if (!zipPath.endsWith('.zip')) {
+      zipPath = `${downloadPath}.zip`;
+      fs.renameSync(downloadPath, zipPath);
+    }
+    await tc.extractZip(zipPath, extPath);
+  } else {
+    await tc.extractTar(downloadPath, extPath);
+  }
+  core.debug(`Extracted to ${extPath}`);
+
+  if (useCache) {
+    await saveCache(cacheKey, extPath);
+  }
+
+  const cachePath: string = await tc.cacheDir(extPath, distribution, toolVersion);
+  core.debug(`Cached to ${cachePath}`);
+
+  return getExePath(cachePath);
+}
+
+const getExePath = (dir: string): string => {
+  return path.join(dir, context.osPlat == 'win32' ? 'goreleaser.exe' : 'goreleaser');
+};
+
+async function restoreCache(key: string, dest: string): Promise<boolean> {
+  try {
+    const hit = await cache.restoreCache([dest], key);
+    if (!hit) {
+      core.info(`No GitHub Actions cache entry for ${key}`);
+      return false;
+    }
+    if (!fs.existsSync(getExePath(dest))) {
+      core.warning(`Ignoring incomplete GitHub Actions cache entry ${hit}`);
+      await io.rmRF(dest);
+      return false;
+    }
+    core.info(`Restored ${hit} from the GitHub Actions cache`);
+    return true;
+  } catch (e) {
+    logCacheError(`Unable to restore ${key} from the GitHub Actions cache`, e);
+    return false;
+  }
+}
+
+async function saveCache(key: string, src: string): Promise<void> {
+  try {
+    await cache.saveCache([src], key);
+    core.info(`Saved ${key} to the GitHub Actions cache`);
+  } catch (e) {
+    logCacheError(`Unable to save ${key} to the GitHub Actions cache`, e);
+  }
+}
+
+// A read-only cache token (fork pull requests) and a key already reserved by a
+// concurrent job are expected, so they must not raise a warning annotation.
+const logCacheError = (message: string, e: Error): void => {
+  const expected = e instanceof cache.ReserveCacheError || e instanceof cache.CacheReadDeniedError;
+  (expected ? core.info : core.warning)(`${message}: ${e.message}`);
+};
+
+export async function verifyChecksum(
+  distribution: string,
+  tag: string,
+  archivePath: string,
+  filename: string
+): Promise<void> {
+  const baseUrl = `https://github.com/goreleaser/${distribution}/releases/download/${tag}`;
+  let checksumsPath: string;
+  try {
+    core.info(`Downloading ${baseUrl}/checksums.txt`);
+    checksumsPath = await tc.downloadTool(`${baseUrl}/checksums.txt`);
+  } catch (e) {
+    core.warning(`Skipping checksum verification: unable to download checksums.txt: ${e.message}`);
+    return;
+  }
+
+  const sha256 = crypto.createHash('sha256').update(fs.readFileSync(archivePath)).digest('hex');
+  const expected = findChecksum(fs.readFileSync(checksumsPath, 'utf8'), filename);
+  if (!expected) {
+    throw new Error(`Could not find ${filename} in checksums.txt`);
+  }
+  if (expected.toLowerCase() !== sha256.toLowerCase()) {
+    throw new Error(`Checksum mismatch for ${filename}: expected ${expected}, got ${sha256}`);
+  }
+  core.info(`Checksum verified for ${filename}`);
+
+  await verifyCosignSignature(distribution, tag, baseUrl, checksumsPath);
+}
+
+export const findChecksum = (checksumsContent: string, filename: string): string | undefined => {
+  const match = checksumsContent
+    .split('\n')
+    .map(line => line.trim().split(/\s+/))
+    .find(parts => parts.length >= 2 && parts[1].replace(/^[*]/, '') === filename);
+  return match ? match[0] : undefined;
+};
+
+async function verifyCosignSignature(
+  distribution: string,
+  tag: string,
+  baseUrl: string,
+  checksumsPath: string
+): Promise<void> {
+  const cosign = await io.which('cosign', false);
+  if (!cosign) {
+    core.info('cosign not found in PATH, skipping signature verification');
+    return;
+  }
+
+  let bundlePath: string;
+  try {
+    core.info(`Downloading ${baseUrl}/checksums.txt.sigstore.json`);
+    bundlePath = await tc.downloadTool(`${baseUrl}/checksums.txt.sigstore.json`);
+  } catch (e) {
+    core.warning(`Skipping cosign signature verification: unable to download sigstore bundle: ${e.message}`);
+    return;
+  }
+
+  const certificateIdentity = getCertificateIdentity(distribution, tag);
+  core.info(`Verifying checksums.txt signature with cosign (identity: ${certificateIdentity})`);
+  await exec.exec(cosign, [
+    'verify-blob',
+    '--certificate-identity',
+    certificateIdentity,
+    '--certificate-oidc-issuer',
+    'https://token.actions.githubusercontent.com',
+    '--bundle',
+    bundlePath,
+    checksumsPath
+  ]);
+  core.info('cosign signature verified');
+}
+
+export const getCertificateIdentity = (distribution: string, tag: string): string => {
+  const pro = isPro(distribution);
+  if (github.isNightlyTag(tag)) {
+    const workflow = pro ? 'nightly-pro.yml' : 'nightly-oss.yml';
+    const repo = pro ? 'goreleaser-pro-internal' : 'goreleaser';
+    return `https://github.com/goreleaser/${repo}/.github/workflows/${workflow}@refs/heads/main`;
+  }
+  if (pro) {
+    return `https://github.com/goreleaser/goreleaser-pro-internal/.github/workflows/release-pro.yml@refs/tags/${tag}`;
+  }
+  return `https://github.com/goreleaser/goreleaser/.github/workflows/release.yml@refs/tags/${tag}`;
+};
+
+export const distribSuffix = (distribution: string): string => {
+  return isPro(distribution) ? '-pro' : '';
+};
+
+export const isPro = (distribution: string): boolean => {
+  return distribution === 'goreleaser-pro';
+};
+
+const getFilename = (distribution: string): string => {
+  let arch: string;
+  switch (context.osArch) {
+    case 'x64': {
+      arch = 'x86_64';
+      break;
+    }
+    case 'x32': {
+      arch = 'i386';
+      break;
+    }
+    case 'arm': {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const arm_version = (process.config.variables as any).arm_version;
+      arch = arm_version ? 'armv' + arm_version : 'arm';
+      break;
+    }
+    default: {
+      arch = context.osArch;
+      break;
+    }
+  }
+  if (context.osPlat == 'darwin') {
+    arch = 'all';
+  }
+  const platform: string = context.osPlat == 'win32' ? 'Windows' : context.osPlat == 'darwin' ? 'Darwin' : 'Linux';
+  const ext: string = context.osPlat == 'win32' ? 'zip' : 'tar.gz';
+  const suffix: string = distribSuffix(distribution);
+  return `goreleaser${suffix}_${platform}_${arch}.${ext}`;
+};
+
+export async function getDistPath(yamlfile: string): Promise<string> {
+  const cfg = yaml.load(fs.readFileSync(yamlfile, 'utf8')) as {dist?: string};
+  return cfg.dist || 'dist';
+}
+
+export async function getArtifacts(distpath: string): Promise<string | undefined> {
+  const artifactsFile = path.join(distpath, 'artifacts.json');
+  if (!fs.existsSync(artifactsFile)) {
+    return undefined;
+  }
+  const content = fs.readFileSync(artifactsFile, {encoding: 'utf-8'}).trim();
+  if (content === 'null') {
+    return undefined;
+  }
+  return content;
+}
+
+export async function getMetadata(distpath: string): Promise<string | undefined> {
+  const metadataFile = path.join(distpath, 'metadata.json');
+  if (!fs.existsSync(metadataFile)) {
+    return undefined;
+  }
+  const content = fs.readFileSync(metadataFile, {encoding: 'utf-8'}).trim();
+  if (content === 'null') {
+    return undefined;
+  }
+  return content;
+}

src/installer.ts

@@ -1,52 +0,0 @@
-import * as os from 'os';
-import * as path from 'path';
-import * as util from 'util';
-import * as github from './github';
-import * as core from '@actions/core';
-import * as tc from '@actions/tool-cache';
-
-const osPlat: string = os.platform();
-const osArch: string = os.arch();
-
-export async function getGoReleaser(version: string): Promise<string> {
-  const release: github.GitHubRelease | null = await github.getRelease(version);
-  if (!release) {
-    throw new Error(`Cannot find GoReleaser ${version} release`);
-  }
-
-  core.info(`✅ GoReleaser version found: ${release.tag_name}`);
-  const filename = getFilename();
-  const downloadUrl = util.format(
-    'https://github.com/goreleaser/goreleaser/releases/download/%s/%s',
-    release.tag_name,
-    filename
-  );
-
-  core.info(`⬇️ Downloading ${downloadUrl}...`);
-  const downloadPath: string = await tc.downloadTool(downloadUrl);
-  core.debug(`Downloaded to ${downloadPath}`);
-
-  core.info('📦 Extracting GoReleaser...');
-  let extPath: string;
-  if (osPlat == 'win32') {
-    extPath = await tc.extractZip(downloadPath);
-  } else {
-    extPath = await tc.extractTar(downloadPath);
-  }
-  core.debug(`Extracted to ${extPath}`);
-
-  const cachePath: string = await tc.cacheDir(extPath, 'goreleaser-action', release.tag_name.replace(/^v/, ''));
-  core.debug(`Cached to ${cachePath}`);
-
-  const exePath: string = path.join(cachePath, osPlat == 'win32' ? 'goreleaser.exe' : 'goreleaser');
-  core.debug(`Exe path is ${exePath}`);
-
-  return exePath;
-}
-
-const getFilename = (): string => {
-  const platform: string = osPlat == 'win32' ? 'Windows' : osPlat == 'darwin' ? 'Darwin' : 'Linux';
-  const arch: string = osArch == 'x64' ? 'x86_64' : 'i386';
-  const ext: string = osPlat == 'win32' ? 'zip' : 'tar.gz';
-  return util.format('goreleaser_%s_%s.%s', platform, arch, ext);
-};

src/main.ts

@@ -1,53 +1,74 @@
-import * as git from './git';
-import * as installer from './installer';
+import * as fs from 'fs';
+import * as path from 'path';
+import yargs from 'yargs';
+import type {Arguments} from 'yargs';
+import * as context from './context';
+import * as goreleaser from './goreleaser';
+import {getRequestedVersion} from './version';
 import * as core from '@actions/core';
 import * as exec from '@actions/exec';
-import {dirname} from 'path';
 
 async function run(): Promise<void> {
   try {
-    const version = core.getInput('version') || 'latest';
-    const args = core.getInput('args');
-    const workdir = core.getInput('workdir') || '.';
-    const isInstallOnly = /^true$/i.test(core.getInput('install-only'));
-    const goreleaser = await installer.getGoReleaser(version);
-    core.info(`✅ GoReleaser installed successfully`);
+    const inputs: context.Inputs = await context.getInputs();
+    const version = getRequestedVersion(inputs);
+    const bin = await goreleaser.install(inputs.distribution, version, inputs.cacheBinary);
+    core.info(`GoReleaser ${version} installed successfully`);
 
-    if (isInstallOnly) {
-      const goreleaserDir = dirname(goreleaser);
+    if (inputs.installOnly) {
+      const goreleaserDir = path.dirname(bin);
       core.addPath(goreleaserDir);
       core.debug(`Added ${goreleaserDir} to PATH`);
       return;
-    } else if (!args) {
-      throw new Error('args input required');
+    } else if (!inputs.args) {
+      core.setFailed('args input required');
+      return;
     }
 
-    if (workdir && workdir !== '.') {
-      core.info(`📂 Using ${workdir} as working directory...`);
-      process.chdir(workdir);
+    if (inputs.workdir && inputs.workdir !== '.') {
+      core.info(`Using ${inputs.workdir} as working directory`);
+      process.chdir(inputs.workdir);
     }
 
-    const commit = await git.getShortCommit();
-    const tag = await git.getTag();
-    const isTagDirty = await git.isTagDirty(tag);
-
-    let snapshot = '';
-    if (args.split(' ').indexOf('release') > -1) {
-      if (isTagDirty) {
-        core.info(`⚠️ No tag found for commit ${commit}. Snapshot forced`);
-        if (!args.includes('--snapshot')) {
-          snapshot = ' --snapshot';
+    let yamlfile: string | unknown;
+    const argv: Arguments<{config?: string}> = yargs(inputs.args).parseSync() as Arguments<{
+      config?: string;
+    }>;
+    if (argv.config) {
+      yamlfile = argv.config;
+    } else {
+      [
+        '.config/goreleaser.yaml',
+        '.config/goreleaser.yml',
+        '.goreleaser.yaml',
+        '.goreleaser.yml',
+        'goreleaser.yaml',
+        'goreleaser.yml'
+      ].forEach(f => {
+        if (fs.existsSync(f)) {
+          yamlfile = f;
         }
-      } else {
-        core.info(`✅ ${tag} tag found for commit ${commit}`);
+      });
+    }
+
+    await exec.exec(`${bin} ${inputs.args}`);
+
+    if (typeof yamlfile === 'string') {
+      const artifacts = await goreleaser.getArtifacts(await goreleaser.getDistPath(yamlfile));
+      if (artifacts) {
+        await core.group(`Artifacts output`, async () => {
+          core.info(artifacts);
+          core.setOutput('artifacts', artifacts);
+        });
+      }
+      const metadata = await goreleaser.getMetadata(await goreleaser.getDistPath(yamlfile));
+      if (metadata) {
+        await core.group(`Metadata output`, async () => {
+          core.info(metadata);
+          core.setOutput('metadata', metadata);
+        });
       }
     }
-
-    core.info('🏃 Running GoReleaser...');
-    if (!('GORELEASER_CURRENT_TAG' in process.env)) {
-      process.env.GORELEASER_CURRENT_TAG = tag;
-    }
-    await exec.exec(`${goreleaser} ${args}${snapshot}`);
   } catch (error) {
     core.setFailed(error.message);
   }

src/test_setup.ts

@@ -1,4 +1,4 @@
-import tmp = require('tmp');
+import * as tmp from 'tmp';
 
 tmp.setGracefulCleanup();
 const tmpdir = tmp.dirSync({template: 'goreleaser-XXXXXX'});

src/version.ts

@@ -0,0 +1,56 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import {Inputs} from './context';
+
+// Resolves the GoReleaser version to install.
+//
+// When `version-file` is set, it is read from disk and parsed; the resolved
+// value takes precedence over the `version` input. Otherwise, `version` is
+// returned as-is (it always has a default — see context.getInputs).
+export function getRequestedVersion(inputs: Inputs): string {
+  if (!inputs.versionFile) {
+    return inputs.version;
+  }
+
+  const filePath = path.isAbsolute(inputs.versionFile)
+    ? inputs.versionFile
+    : path.join(inputs.workdir || '.', inputs.versionFile);
+
+  if (!fs.existsSync(filePath)) {
+    throw new Error(`version-file not found: ${filePath}`);
+  }
+
+  const basename = path.basename(filePath);
+  const content = fs.readFileSync(filePath, 'utf-8');
+
+  switch (basename) {
+    case '.tool-versions':
+      return parseToolVersions(content, filePath);
+    default:
+      throw new Error(`Unsupported version-file: ${filePath} (only .tool-versions is supported)`);
+  }
+}
+
+// Parses a single `goreleaser <version>` entry out of a `.tool-versions` file
+// (asdf/mise format). Full-line `#` comments and inline `# ...` suffixes are
+// stripped. When a tool lists multiple fallback versions only the first is
+// used. Bare semvers are returned with a leading `v`; constraint expressions
+// (`~> v2`, `latest`, ...) are returned as-is.
+function parseToolVersions(content: string, filePath: string): string {
+  for (const rawLine of content.split('\n')) {
+    const line = rawLine.replace(/#.*$/, '').trim();
+    if (!line) {
+      continue;
+    }
+    const tokens = line.split(/\s+/);
+    if (tokens[0] !== 'goreleaser') {
+      continue;
+    }
+    const version = tokens[1];
+    if (!version) {
+      throw new Error(`No version specified for goreleaser in ${filePath}`);
+    }
+    return /^\d/.test(version) ? `v${version}` : version;
+  }
+  throw new Error(`No goreleaser entry found in ${filePath}`);
+}

test/.goreleaser-dist.yml

@@ -0,0 +1,18 @@
+env:
+  - GO111MODULE=on
+
+before:
+  hooks:
+    - go mod download
+
+builds:
+  -
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - darwin
+      - linux
+    goarch:
+      - amd64
+
+dist: _output

test/.goreleaser-signing.yml

@@ -14,17 +14,8 @@ builds:
       - linux
       - windows
     goarch:
-      - 386
-      - amd64
-
-archives:
-  -
-    replacements:
-      386: i386
-      amd64: x86_64
-    format_overrides:
-      - goos: windows
-        format: zip
+      - "386"
+      - "amd64"
 
 checksum:
   name_template: 'checksums.txt'

test/.goreleaser.yml

@@ -14,17 +14,8 @@ builds:
       - linux
       - windows
     goarch:
-      - 386
-      - amd64
-
-archives:
-  -
-    replacements:
-      386: i386
-      amd64: x86_64
-    format_overrides:
-      - goos: windows
-        format: zip
+      - "386"
+      - "amd64"
 
 checksum:
   name_template: 'checksums.txt'

test/go.mod

@@ -1,3 +1,3 @@
 module github.com/goreleaser/goreleaser-action
 
-go 1.15
+go 1.18

tsconfig.json

@@ -1,18 +1,22 @@
 {
   "compilerOptions": {
-    "target": "es6",
-    "module": "commonjs",
-    "lib": [
-      "es6",
-      "dom"
-    ],
+    "esModuleInterop": true,
+    "target": "ES2024",
+    "module": "ESNext",
     "newLine": "lf",
     "outDir": "./lib",
     "rootDir": "./src",
-    "strict": true,
+    "forceConsistentCasingInFileNames": true,
     "noImplicitAny": false,
-    "esModuleInterop": true,
-    "sourceMap": true
+    "resolveJsonModule": true,
+    "useUnknownInCatchVariables": false,
+    "moduleResolution": "node",
+    "strict": false,
+    "skipLibCheck": true
   },
-  "exclude": ["node_modules", "**/*.test.ts"]
+  "exclude": [
+    "node_modules",
+    "**/*.test.ts",
+    "jest.config.ts"
+  ]
 }