Repository: goreleaser/goreleaser
Pull request #2722 (2021-12-02 21:56:34)

docs(quickstart): minimum github_token perms
# Commit Message
after testing, this is what I found

not sure this is the exact way we should write this but it's a start

# If applied, this commit will... 

add additional test to the quickstart docs

# Why is this change being made?

as I am a security minded person, and the goreleaser doesn't state what permissions are required, I thought it would be wise to write in the quickstart docs




Patch:
diff --git a/internal/pipe/sign/sign_docker.go b/internal/pipe/sign/sign_docker.go
index 48b8a767..f8a62868 100644
--- a/internal/pipe/sign/sign_docker.go
+++ b/internal/pipe/sign/sign_docker.go
@@ -28,7 +28,7 @@ func (DockerPipe) Default(ctx *context.Context) error {
 			cfg.Cmd = "cosign"
 		}
 		if len(cfg.Args) == 0 {
-			cfg.Args = []string{"sign", "-key=cosign.key", "$artifact"}
+			cfg.Args = []string{"sign", "--key=cosign.key", "$artifact"}
 		}
 		if cfg.Artifacts == "" {
 			cfg.Artifacts = "none"
diff --git a/pkg/config/config.go b/pkg/config/config.go
index e4527607..f8a69db5 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -194,7 +194,10 @@ type BuildHooks struct { // renamed on pro
 
 // IgnoredBuild represents a build ignored by the user.
 type IgnoredBuild struct {
-	Goos, Goarch, Goarm, Gomips string
+	Goos   string `yaml:"goos,omitempty"`
+	Goarch string `yaml:"goarch,omitempty"`
+	Goarm  string `yaml:"goarm,omitempty"`
+	Gomips string `yaml:"gomips,omitempty"`
 }
 
 // StringArray is a wrapper for an array of strings.
diff --git a/www/docs/customization/docker_sign.md b/www/docs/customization/docker_sign.md
index 1e6ce034..6e7427da 100644
--- a/www/docs/customization/docker_sign.md
+++ b/www/docs/customization/docker_sign.md
@@ -26,8 +26,8 @@ docker_signs:
 
     # Command line templateable arguments for the command
     #
-    # defaults to `["sign", "-key=cosign.key", "${artifact}"]`
-    args: ["sign", "-key=cosign.key", "-upload=false", "${artifact}"]
+    # defaults to `["sign", "--key=cosign.key", "${artifact}"]`
+    args: ["sign", "--key=cosign.key", "--upload=false", "${artifact}"]
 
 
     # Which artifacts to sign
@@ -90,5 +90,5 @@ docker_signs:
 Later on you (and anyone else) can verify the image with:
 
 ```sh
-cosign verify -key cosign.pub your/image
+cosign verify --key cosign.pub your/image
 ```
diff --git a/www/docs/customization/sign.md b/www/docs/customization/sign.md
index 5aa938f2..c15c6aba 100644
--- a/www/docs/customization/sign.md
+++ b/www/docs/customization/sign.md
@@ -119,7 +119,7 @@ Assuming you have a `cosign.key` in the repository root and a `COSIGN_PWD` envir
 signs:
 - cmd: cosign
   stdin: '{{ .Env.COSIGN_PWD }}'
-  args: ["sign-blob", "-key=cosign.key", "-output=${signature}", "${artifact}"]
+  args: ["sign-blob", "--key=cosign.key", "--output=${signature}", "${artifact}"]
   artifacts: all
 ```
 
@@ -202,7 +202,7 @@ but you'll need to manually add the `.sig` files to the release and/or archive:
 builds:
 - hooks:
     post:
-      - sh -c "echo $COSIGN_PWD | cosign sign-blob -key cosign.key {{ .Path }} > dist/{{ .ProjectName }}_{{ .Version }}_{{ .Target }}.sig"
+      - sh -c "COSIGN_PASSWORD=$COSIGN_PWD cosign sign-blob --key cosign.key --output dist/{{ .ProjectName }}_{{ .Version }}_{{ .Target }}.sig {{ .Path }}"
 
 # add to the release directly:
 release:
diff --git a/www/docs/quick-start.md b/www/docs/quick-start.md
index 5857db61..05329708 100644
--- a/www/docs/quick-start.md
+++ b/www/docs/quick-start.md
@@ -44,6 +44,9 @@ In order to release to GitHub, you'll need to export a `GITHUB_TOKEN` environmen
 It will be used to deploy releases to your GitHub repository.
 You can create a new github token [here](https://github.com/settings/tokens/new).
 
+!!! info
+    The minimum permissions the `GITHUB_TOKEN` should have to run this are `write:packages`
+
 ```sh
 export GITHUB_TOKEN="YOUR_GH_TOKEN"
 ```
diff --git a/www/docs/static/schema.json b/www/docs/static/schema.json
index a24e5ead..68123688 100644
--- a/www/docs/static/schema.json
+++ b/www/docs/static/schema.json
@@ -880,23 +880,17 @@
 				]
 			},
 			"IgnoredBuild": {
-				"required": [
-					"Goos",
-					"Goarch",
-					"Goarm",
-					"Gomips"
-				],
 				"properties": {
-					"Goos": {
+					"goos": {
 						"type": "string"
 					},
-					"Goarch": {
+					"goarch": {
 						"type": "string"
 					},
-					"Goarm": {
+					"goarm": {
 						"type": "string"
 					},
-					"Gomips": {
+					"gomips": {
 						"type": "string"
 					}
 				},


Test patch:
diff --git a/internal/pipe/sign/sign_docker_test.go b/internal/pipe/sign/sign_docker_test.go
index 9a4f4954..05747a6a 100644
--- a/internal/pipe/sign/sign_docker_test.go
+++ b/internal/pipe/sign/sign_docker_test.go
@@ -25,7 +25,7 @@ func TestDockerSignDefault(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, ctx.Config.DockerSigns[0].Cmd, "cosign")
 	require.Equal(t, ctx.Config.DockerSigns[0].Signature, "")
-	require.Equal(t, ctx.Config.DockerSigns[0].Args, []string{"sign", "-key=cosign.key", "$artifact"})
+	require.Equal(t, ctx.Config.DockerSigns[0].Args, []string{"sign", "--key=cosign.key", "$artifact"})
 	require.Equal(t, ctx.Config.DockerSigns[0].Artifacts, "none")
 }
 
@@ -69,7 +69,7 @@ func TestDockerSignArtifacts(t *testing.T) {
 					Artifacts: "all",
 					Stdin:     &password,
 					Cmd:       "cosign",
-					Args:      []string{"sign", "-key=" + key, "-upload=false", "${artifact}"},
+					Args:      []string{"sign", "--key=" + key, "-upload=false", "${artifact}"},
 				},
 			},
 		},