Use named context to wrap artifacts and create checksums

.dockerignore

@@ -4,5 +4,6 @@
 /.dev
 /bin
 /dist
+/release
 /site
 /coverage.txt

.github/workflows/build.yml

@@ -113,15 +113,16 @@ jobs:
           targets: artifact-all
           pull: true
       -
-        name: Move artifacts
-        run: |
-          mv ./dist/**/* ./dist/
+        name: Release
+        uses: docker/bake-action@v2
+        with:
+          targets: release
       -
         name: Upload artifacts
         uses: actions/upload-artifact@v3
         with:
           name: diun
-          path: ./dist/*
+          path: ./release/*
           if-no-files-found: error
       -
         name: Build image
@@ -140,8 +141,7 @@ jobs:
         with:
           draft: true
           files: |
-            dist/*.tar.gz
-            dist/*.zip
+            release/*
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       -

.gitignore

@@ -4,5 +4,6 @@
 /.dev
 /bin
 /dist
+/release
 /site
 /coverage.txt

Dockerfile

@@ -79,6 +79,20 @@ EOT
 FROM scratch AS artifact
 COPY --link --from=build-artifact /out /
 
+FROM scratch AS artifacts
+FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS releaser
+RUN apk add --no-cache bash coreutils
+WORKDIR /out
+RUN --mount=from=artifacts,source=.,target=/artifacts <<EOT
+  set -e
+  cp /artifacts/**/* /out/ 2>/dev/null || cp /artifacts/* /out/
+  sha256sum -b diun_* > ./checksums.txt
+  sha256sum -c --strict checksums.txt
+EOT
+
+FROM scratch AS release
+COPY --link --from=releaser /out /
+
 FROM alpine:${ALPINE_VERSION}
 RUN apk --update --no-cache add ca-certificates openssl
 COPY --from=build /usr/bin/diun /usr/local/bin/diun

docker-bake.hcl

@@ -49,6 +49,14 @@ target "artifact-all" {
   ]
 }
 
+target "release" {
+  target = "release"
+  output = ["./release"]
+  contexts = {
+    artifacts = "./dist"
+  }
+}
+
 target "image" {
   inherits = ["_common", "docker-metadata-action"]
 }