build(release): add tag-based release automation and version metadata

.github/workflows/docker-alpine.yml

@@ -1,28 +1,46 @@
 name: docker-alpine-epusdt
-on:
-  workflow_dispatch: #github页面手动触发
-  push:
-    branches: [ "main" ]
-env:
-  IMAGE_NAME: epusdt #这是您的镜像名
 
-jobs:        
-  push-docker-hub:    
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - "main"
+
+env:
+  IMAGE_NAME: epusdt
+
+jobs:
+  push-docker-hub:
     runs-on: ubuntu-latest
     env:
       TZ: Asia/Shanghai
+
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
+
+      - name: Compute Build Metadata
+        id: meta
+        shell: bash
+        run: |
+          echo "version=main-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+          echo "commit=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+          echo "date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+
       - name: Login
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Build && Push
-        uses: docker/build-push-action@v4
+
+      - name: Build And Push
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
           push: true
-          tags: |            
+          build-args: |
+            VERSION=${{ steps.meta.outputs.version }}
+            COMMIT=${{ steps.meta.outputs.commit }}
+            DATE=${{ steps.meta.outputs.date }}
+          tags: |
             ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:alpine

.github/workflows/release.yml

@@ -0,0 +1,62 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  goreleaser:
+    name: Build And Publish Binaries
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Ensure Tag Commit Is On Default Branch
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          git fetch origin "$DEFAULT_BRANCH" --depth=1
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" "origin/$DEFAULT_BRANCH"; then
+            echo "tag ${GITHUB_REF_NAME} must reference a commit reachable from ${DEFAULT_BRANCH}"
+            exit 1
+          fi
+
+      - name: Set Up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: src/go.mod
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v4.1.1
+
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@v0.24.0
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          workdir: src
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Attest Release Checksums
+        uses: actions/attest@v4
+        with:
+          subject-checksums: src/dist/epusdt_${{ github.ref_name }}_checksums.txt