Repository: goreleaser/goreleaser
Pull request #1493 (2020-05-10 15:38:36)

feat: allow to template signs.args
allow to use templates in `signs.args`


Patch:
diff --git a/internal/pipe/sign/sign.go b/internal/pipe/sign/sign.go
index 0bfa07b4..bffba548 100644
--- a/internal/pipe/sign/sign.go
+++ b/internal/pipe/sign/sign.go
@@ -12,8 +12,10 @@ import (
 	"github.com/goreleaser/goreleaser/internal/logext"
 	"github.com/goreleaser/goreleaser/internal/pipe"
 	"github.com/goreleaser/goreleaser/internal/semerrgroup"
+	"github.com/goreleaser/goreleaser/internal/tmpl"
 	"github.com/goreleaser/goreleaser/pkg/config"
 	"github.com/goreleaser/goreleaser/pkg/context"
+	"github.com/pkg/errors"
 )
 
 // Pipe for artifact signing.
@@ -106,7 +108,12 @@ func signone(ctx *context.Context, cfg config.Sign, a *artifact.Artifact) (*arti
 	// nolint:prealloc
 	var args []string
 	for _, a := range cfg.Args {
-		args = append(args, expand(a, env))
+		var arg = expand(a, env)
+		arg, err := tmpl.New(ctx).WithEnv(env).Apply(arg)
+		if err != nil {
+			return nil, errors.Wrapf(err, "sign failed: %s: invalid template", a)
+		}
+		args = append(args, arg)
 	}
 
 	// The GoASTScanner flags this as a security risk.
diff --git a/www/content/actions.md b/www/content/actions.md
index 5ad1d83d..ca766d82 100644
--- a/www/content/actions.md
+++ b/www/content/actions.md
@@ -10,6 +10,10 @@ through [GitHub Actions][actions].
 You can create a workflow for pushing your releases by putting YAML configuration to
 `.github/workflows/release.yml`.
 
+## Usage
+
+### Workflow
+
 Below is a simple snippet to use this action in your workflow:
 
 ```yaml
@@ -36,11 +40,10 @@ jobs:
           go-version: 1.14
       -
         name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v1
+        uses: goreleaser/goreleaser-action@v2
         with:
           version: latest
           args: release --rm-dist
-          key: ${{ secrets.YOUR_PRIVATE_KEY }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
@@ -48,6 +51,8 @@ jobs:
 > **IMPORTANT**: note the `Unshallow` workflow step. It is required for the
 > changelog to work correctly.
 
+### Run on new tag
+
 If you want to run GoReleaser only on new tag, you can use this event:
 
 ```yaml
@@ -62,18 +67,47 @@ Or with a condition on GoReleaser step:
 ```yaml
       -
         name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v1
+        uses: goreleaser/goreleaser-action@v2
         if: startsWith(github.ref, 'refs/tags/')
         with:
           version: latest
           args: release --rm-dist
-          key: ${{ secrets.YOUR_PRIVATE_KEY }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
 
 > For detailed instructions please follow GitHub Actions [workflow syntax][syntax].
 
+### Signing
+
+If [signing is enabled][signing] in your GoReleaser configuration, you can use the [Import GPG][import-gpg]
+GitHub Action along with this one:
+
+```yaml
+      -
+        name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@v1
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          PASSPHRASE: ${{ secrets.PASSPHRASE }}
+      -
+        name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v2
+        with:
+          version: latest
+          args: release --rm-dist
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+```
+
+And reference the userID in your signing configuration:
+
+```yaml
+signs:
+  - artifacts: checksum
+    args: ["--batch", "-u", "<key id, fingerprint, email, ...>", "--output", "${signature}", "--detach-sign", "${artifact}"]
+```
+
 ## Customizing
 
 ### inputs
@@ -84,7 +118,6 @@ Following inputs can be used as `step.with` keys
 |---------------|---------|-----------|-------------------------------------------|
 | `version`     | String  | `latest`  | GoReleaser version. Example: `v0.117.0`   |
 | `args`        | String  |           | Arguments to pass to GoReleaser           |
-| `key`         | String  |           | Private key to import                     |
 | `workdir`     | String  | `.`       | Working directory (below repository root) |
 
 ### environment variables
@@ -106,33 +139,19 @@ create a secret named `GH_PAT`, the step will look like this:
 ```yaml
       -
         name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v1
+        uses: goreleaser/goreleaser-action@v2
         with:
           version: latest
           args: release --rm-dist
-          key: ${{ secrets.YOUR_PRIVATE_KEY }}
         env:
           GITHUB_TOKEN: ${{ secrets.GH_PAT }}
 ```
 
-## Signing
-
-If signing is enabled in your GoReleaser configuration, populate the
-`key` input with your private key and reference the key in your signing
-configuration, e.g.
-
-```yaml
-signs:
-  - artifacts: checksum
-    args: ["--batch", "-u", "<key id, fingerprint, email, ...>", "--output", "${signature}", "--detach-sign", "${artifact}"]
-```
-
-This feature is currently only compatible when using the default `gpg`
-command and a private key without a passphrase.
-
 [goreleaser-action]: https://github.com/goreleaser/goreleaser-action
 [actions]: https://github.com/features/actions
 [syntax]: https://help.github.com/en/articles/workflow-syntax-for-github-actions#About-yaml-syntax-for-workflows
+[signing]: https://goreleaser.com/customization/#Signing
+[import-gpg]: https://github.com/crazy-max/ghaction-import-gpg
 [github-token]: https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token
 [about-github-token]: https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token#about-the-github_token-secret
 [pat]: https://help.github.com/articles/creating-a-personal-access-token-for-the-command-line/
diff --git a/www/content/archive.md b/www/content/archive.md
index 3f6d661a..b41619f6 100644
--- a/www/content/archive.md
+++ b/www/content/archive.md
@@ -121,3 +121,13 @@ extracted with something like `gzip -d file.gz`.
 
 Multiple builds will also not work in this case and will be handled on
 [#705](https://github.com/goreleaser/goreleaser/issues/705).
+
+## Disable archiving
+
+You can do that by setting `format` to `binary`:
+
+```yaml
+# goreleaser.yml
+archives:
+- format: binary
+```
diff --git a/www/content/sign.md b/www/content/sign.md
index e114d379..d0147f2f 100644
--- a/www/content/sign.md
+++ b/www/content/sign.md
@@ -47,13 +47,13 @@ signs:
     # defaults to `gpg`
     cmd: gpg2
 
-    # command line arguments for the command
+    # command line templateable arguments for the command
     #
     # to sign with a specific key use
     # args: ["-u", "<key id, fingerprint, email, ...>", "--output", "${signature}", "--detach-sign", "${artifact}"]
     #
     # defaults to `["--output", "${signature}", "--detach-sign", "${artifact}"]`
-    args: ["--output", "${signature}", "${artifact}"]
+    args: ["--output", "${signature}", "${artifact}", "{{ .ProjectName }}"]
 
 
     # which artifacts to sign


Test patch:
diff --git a/internal/pipe/sign/sign_test.go b/internal/pipe/sign/sign_test.go
index e69498d4..046adaea 100644
--- a/internal/pipe/sign/sign_test.go
+++ b/internal/pipe/sign/sign_test.go
@@ -101,6 +101,24 @@ func TestSignArtifacts(t *testing.T) {
 				},
 			),
 		},
+		{
+			desc:           "invalid args template",
+			expectedErrMsg: `sign failed: ${FOO}-{{ .foo }{{}}{: invalid template: template: tmpl:1: unexpected "}" in operand`,
+			ctx: context.New(
+				config.Project{
+					Signs: []config.Sign{
+						{
+							Artifacts: "all",
+							Cmd:       "exit",
+							Args:      []string{"${FOO}-{{ .foo }{{}}{"},
+						},
+					},
+					Env: []string{
+						"FOO=BAR",
+					},
+				},
+			),
+		},
 		{
 			desc: "sign single",
 			ctx: context.New(
@@ -226,6 +244,31 @@ func TestSignArtifacts(t *testing.T) {
 			signaturePaths: []string{"artifact1.sig", "artifact2.sig", "artifact3.sig", "checksum.sig", "checksum2.sig", "linux_amd64/artifact4.sig"},
 			signatureNames: []string{"artifact1.sig", "artifact2.sig", "artifact3_1.0.0_linux_amd64.sig", "checksum.sig", "checksum2.sig", "artifact4_1.0.0_linux_amd64.sig"},
 		},
+		{
+			desc: "sign all artifacts with template",
+			ctx: context.New(
+				config.Project{
+					Signs: []config.Sign{
+						{
+							Artifacts: "all",
+							Args: []string{
+								"-u",
+								"{{ .Env.SOME_TEST_USER }}",
+								"--output",
+								"${signature}",
+								"--detach-sign",
+								"${artifact}",
+							},
+						},
+					},
+					Env: []string{
+						fmt.Sprintf("SOME_TEST_USER=%s", user),
+					},
+				},
+			),
+			signaturePaths: []string{"artifact1.sig", "artifact2.sig", "artifact3.sig", "checksum.sig", "checksum2.sig", "linux_amd64/artifact4.sig"},
+			signatureNames: []string{"artifact1.sig", "artifact2.sig", "artifact3_1.0.0_linux_amd64.sig", "checksum.sig", "checksum2.sig", "artifact4_1.0.0_linux_amd64.sig"},
+		},
 	}
 
 	for _, test := range tests {