chore: rework release pipeline [no ci]

.github/workflows/release.yml

@@ -1,10 +1,9 @@
-name: release
+name: Release
 
 on:
   push:
     tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+'
-  workflow_dispatch:
+      - 'v*'
 
 permissions:
    contents: write
@@ -20,6 +19,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: 1.22
+          cache: true
       - uses: ko-build/setup-ko@v0.6
       - uses: sigstore/cosign-installer@v3.3.0
         with:
@@ -27,7 +27,7 @@ jobs:
       - uses: goreleaser/goreleaser-action@v5
         with:
           version: v1.24.0
-          args: release --clean --timeout 90m
+          args: release --clean
         env:
           GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
           COSIGN_PASSWORD: '${{ secrets.COSIGN_PASSWORD }}'

.goreleaser.yaml

@@ -12,6 +12,24 @@ builds:
       - windows
       - darwin
 
+checksum:
+  name_template: 'checksums.txt'
+
+signs:
+  - id: checksums
+    cmd: cosign
+    stdin: '{{ .Env.COSIGN_PASSWORD }}'
+    output: true
+    artifacts: checksum
+    args:
+      - sign-blob
+      - --yes
+      - --key
+      - env://COSIGN_PRIVATE_KEY
+      - '--output-certificate=${certificate}'
+      - '--output-signature=${signature}'
+      - '${artifact}'
+
 archives:
   - format: tar.gz
     name_template: >-
@@ -21,25 +39,34 @@ archives:
       {{- else if eq .Arch "386" }}i386
       {{- else }}{{ .Arch }}{{ end }}
       {{- if .Arm }}v{{ .Arm }}{{ end }}
-checksum:
-  name_template: 'checksums.txt'
+
+kos:
+  - repository: ghcr.io/a-h/templ
+    platforms:
+    - linux/amd64
+    - linux/arm64
+    tags:
+    - latest
+    - '{{.Tag}}'
+    bare: true
+
+docker_signs:
+  - cmd: cosign
+    artifacts: all
+    output: true
+    args:
+      - sign
+      - --yes
+      - --key
+      - env://COSIGN_PRIVATE_KEY
+      - '${artifact}'
+
 snapshot:
   name_template: "{{ incpatch .Version }}-next"
+
 changelog:
   sort: asc
   filters:
     exclude:
       - '^docs:'
       - '^test:'
-
-kos:
-  - repository: ghcr.io/a-h/templ
-    tags:
-    - 'v{{.Version}}'
-    - latest
-    bare: true
-    preserve_import_paths: false
-    sbom: none
-    platforms:
-    - linux/amd64
-    - linux/arm64