Restore v0.1 release pipelines for binaries and tap

.github/workflows/release-binaries.yml

@@ -0,0 +1,138 @@
+name: release binaries
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      release_ref:
+        description: Git ref to build for a dry run.
+        required: true
+        default: refs/heads/main
+        type: string
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  build:
+    name: "IntentProof Release: Build Binaries"
+    runs-on: ubuntu-latest
+    outputs:
+      artifact_paths: ${{ steps.artifact-paths.outputs.artifact_paths }}
+      release_ref: ${{ steps.release.outputs.release_ref }}
+      release_version: ${{ steps.release.outputs.release_version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref }}
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Resolve release metadata
+        id: release
+        run: |
+          set -euo pipefail
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+            release_ref="${{ inputs.release_ref }}"
+            release_version="0.0.0-dryrun"
+          else
+            release_ref="${GITHUB_REF}"
+            release_version="${GITHUB_REF_NAME#v}"
+          fi
+          source_date_epoch="$(git log -1 --format=%ct)"
+          {
+            echo "release_ref=${release_ref}"
+            echo "release_version=${release_version}"
+            echo "source_date_epoch=${source_date_epoch}"
+          } >> "$GITHUB_OUTPUT"
+
+      - uses: goreleaser/goreleaser-action@v7
+        if: github.event_name != 'workflow_dispatch'
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          SOURCE_DATE_EPOCH: ${{ steps.release.outputs.source_date_epoch }}
+
+      - uses: goreleaser/goreleaser-action@v7
+        if: github.event_name == 'workflow_dispatch'
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean --snapshot --skip=publish
+        env:
+          SOURCE_DATE_EPOCH: ${{ steps.release.outputs.source_date_epoch }}
+
+      - name: Collect binary artifacts
+        id: artifact-paths
+        run: |
+          set -euo pipefail
+          find dist -maxdepth 1 -type f \
+            \( -name 'intentproof_*.tar.gz' -o -name 'intentproof_*.zip' \
+              -o -name 'intentproof-verify_*.tar.gz' -o -name 'intentproof-verify_*.zip' \) \
+            | sort > dist/release-artifacts.txt
+          test -s dist/release-artifacts.txt
+          {
+            echo "artifact_paths<<EOF"
+            cat dist/release-artifacts.txt
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-binary-artifacts
+          path: |
+            dist/release-artifacts.txt
+            dist/intentproof_*.tar.gz
+            dist/intentproof_*.zip
+            dist/intentproof-verify_*.tar.gz
+            dist/intentproof-verify_*.zip
+
+  sign:
+    name: "IntentProof Release: Sign Binary Artifacts"
+    needs: build
+    uses: ./.github/workflows/release-build-sign.yml
+    with:
+      artifact_kind: binary
+      subject_name: intentproof-tools
+      release_version: ${{ needs.build.outputs.release_version }}
+      release_ref: ${{ needs.build.outputs.release_ref }}
+      artifact_paths: ${{ needs.build.outputs.artifact_paths }}
+      artifact_download_name: release-binary-artifacts
+      artifact_download_path: dist
+      sbom_extra_paths: .
+      attest_to_rekor: ${{ github.event_name != 'workflow_dispatch' }}
+
+  publish-signing-metadata:
+    name: "IntentProof Release: Publish Binary Metadata"
+    needs:
+      - build
+      - sign
+    if: github.event_name != 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: release-signing-metadata
+          path: release-signing-metadata
+
+      - name: Upload signing metadata to GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          mapfile -t files < <(find release-signing-metadata -type f | sort)
+          test "${#files[@]}" -gt 0
+          gh release upload "$RELEASE_TAG" "${files[@]}" --clobber