From 47cef2118512da22a20b7c2a878af45bfeaafc4b Mon Sep 17 00:00:00 2001
From: Alessio Biancalana <alessio@dottorblaster.it>
Date: Tue, 27 Oct 2026 10:47:29 +0100
Subject: [PATCH] ci: publish signed release binaries and SBOMs

Signed-off-by: Alessio Biancalana <alessio@dottorblaster.it>
---
 .github/workflows/release.yml | 64 +++++++++++++++++++++++++++++++++++
 .gitignore                    |  1 +
 .goreleaser.yaml              | 53 +++++++++++++++++++++++++++++
 README.md                     | 35 +++++++++++++++++++
 4 files changed, 153 insertions(+)
 create mode 100644 .github/workflows/release.yml
 create mode 100644 .goreleaser.yaml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..df99c00
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,64 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Build and publish release artifacts
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - name: Check out the code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: v3.1.3
+
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+        with:
+          syft-version: v1.55.0
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
+        with:
+          distribution: goreleaser
+          version: v2.19.0
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Verify signatures
+        env:
+          IDENTITY: ${{ github.server_url }}/${{ github.workflow_ref }}
+        run: |
+          set -eu
+          for file in dist/release/*.spdx.json dist/release/*_checksums.txt dist/release/schedctl_*/schedctl; do
+            cosign verify-blob \
+              --bundle "${file}.sigstore.json" \
+              --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+              --certificate-identity "$IDENTITY" \
+              "$file"
+          done
diff --git a/.gitignore b/.gitignore
index 5e54214..a4e2737 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,4 +27,5 @@ go.work.sum
 
 # Local build
 /schedctl
+/dist/release/
 
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
new file mode 100644
index 0000000..ea47b8a
--- /dev/null
+++ b/.goreleaser.yaml
@@ -0,0 +1,53 @@
+version: 2
+
+project_name: schedctl
+
+dist: dist/release
+
+builds:
+  - id: schedctl
+    main: .
+    binary: schedctl
+    env:
+      - CGO_ENABLED=0
+    tags:
+      - containers_image_openpgp
+    flags:
+      - -trimpath
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+    ldflags:
+      - -s -w
+
+archives:
+  - id: schedctl
+    formats:
+      - binary
+    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+
+checksum:
+  name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt"
+  algorithm: sha256
+
+sboms:
+  - artifacts: binary
+    documents:
+      - "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.spdx.json"
+
+signs:
+  - cmd: cosign
+    artifacts: all
+    signature: "${artifact}.sigstore.json"
+    args:
+      - sign-blob
+      - "--bundle=${signature}"
+      - "${artifact}"
+      - "--yes"
+
+release:
+  prerelease: auto
+  mode: keep-existing
+  replace_existing_artifacts: true
diff --git a/README.md b/README.md
index d68d5cd..cc270fe 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,41 @@ sudo zypper in schedctl
 paru -S schedctl
 ```
 
+### Prebuilt binaries
+
+Releases include static Linux binaries for x86_64 (`amd64`) and `arm64`, an
+SPDX SBOM for each binary, and a checksums file. The binaries, SBOMs, and
+checksums are signed with
+[Cosign](https://docs.sigstore.dev/cosign/system_config/installation/) using
+GitHub Actions OIDC. The commands below assume Cosign 3.x.
+
+Download a release:
+
+```sh
+tag=v1.3.1
+gh release download "$tag" --repo schedkit/schedctl
+```
+
+Verify the signatures:
+
+```sh
+tag=v1.3.1
+identity="https://github.com/schedkit/schedctl/.github/workflows/release.yml@refs/tags/$tag"
+for bundle in *.sigstore.json; do
+  cosign verify-blob \
+    --bundle "$bundle" \
+    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+    --certificate-identity "$identity" \
+    "${bundle%.sigstore.json}"
+done
+```
+
+Then check the files against the checksums:
+
+```sh
+sha256sum --check --ignore-missing schedctl_*_checksums.txt
+```
+
 ## Container engine setup
 
 ### Podman