Fix CVE-2020-13283 matching (#170) #22

	name: goreleaser

	on:
	push:
	# run only against tags
	tags:
	- "v0.[0-9]+.[0-9]+"
	- "v1.[0-9]+.[0-9]+"

	env:
	GO_VERSION: 1.22
	GO_RELEASER_VERSION: v1.25.1

	permissions: {}

	jobs:
	goreleaser:
	runs-on: ubuntu-latest
	permissions:
	contents: write
	packages: write
	id-token: write
	steps:
	- uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
	with:
	egress-policy: audit
	- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
	with:
	fetch-depth: 0
	- name: Setup Go
	uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5
	with:
	go-version: ${{ env.GO_VERSION }}
	cache: false
	- uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
	- name: Login to GitHub Container Registry to allow cosign signature push
	run: echo "$DOCKER_PASSWORD" \| docker login ghcr.io --username "$DOCKER_USERNAME" --password-stdin
	env:
	DOCKER_USERNAME: ${{ github.actor }}
	DOCKER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
	- name: Run GoReleaser
	uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5
	with:
	distribution: goreleaser
	version: ${{ env.GO_RELEASER_VERSION }} # Not pinnable by hash, nor does it verify its signature
	args: release --clean
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback