ci: use goreleaser-action

.github/workflows/release.yaml

@@ -24,18 +24,22 @@ jobs:
         with:
           aqua_version: v1.30.1
       - run: cosign version
-      - run: goreleaser -v
       - name: Run GoReleaser
-        run: goreleaser release --rm-dist
+        id: run-goreleaser
+        uses: goreleaser/goreleaser-action@8f67e590f2d095516493f017008adc464e63adb1 # v4.1.0
+        with:
+          version: v1.14.1 # renovate: depName=goreleaser/goreleaser
+          args: release --rm-dist
         env:
           GITHUB_TOKEN: ${{ github.token }}
-      - name: Generate hashes
+      - name: Generate subject
         id: hash
+        env:
+          ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
         run: |
-          # sha256sum generates sha256 hash for all artifacts.
-          # base64 -w0 encodes to base64 and outputs on a single line.
-          # sha256sum artifact1 artifact2 ... | base64 -w0
-          echo "hashes=$(find dist -name "*.tar.gz" -print0 | xargs -0 sha256sum | base64 -w0)" >> "$GITHUB_OUTPUT"
+          set -euo pipefail
+          checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
+          echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
 
   provenance:
     needs: [build]

aqua.yaml

@@ -11,5 +11,4 @@ registries:
   - type: standard
     ref: v3.116.0 # renovate: depName=aquaproj/aqua-registry
 packages:
-  - name: goreleaser/[email protected]
   - name: sigstore/[email protected]