Is it possible to create a release for a repository containing a Go library -- no Binary -- and generate a checksum.txt?

[mgingios]

Hello,

I am able to create a GO library release at github using goreleaser, but I am not able to sign the archives containing source code that is in the release and include a checksum. If I had a binary Go application to release, I have it working properly. I'd appreciate a hint. :)

// The Assets in the GitHub release after using the following configurations

Thank you for your interest and time,
Mike

// .goreleaser.yaml

builds:
  - skip: true

archives:
  - format: tar.gz
    # this name template makes the OS and Arch compatible with the results of `uname`.
    name_template: >-
      {{ .ProjectName }}_
      {{- title .Os }}_
      {{- if eq .Arch "amd64" }}x86_64
      {{- else if eq .Arch "386" }}i386
      {{- else }}{{ .Arch }}{{ end }}
      {{- if .Arm }}v{{ .Arm }}{{ end }}
    # use zip for windows archives
    format_overrides:
      - goos: windows
        format: zip

snapshot:
  name_template: '{{ .Version }}-SNAPSHOT-{{ .ShortCommit }}'

checksum:
  name_template: checksums.txt
  algorithm: sha256

changelog:
  sort: asc
  filters:
    exclude:
      - "^docs:"
      - "^test:"
release:
  draft: false

signs:
  - cmd: cosign
    args:
      - "sign-blob"
      - "--key=security/cosign.key"
      - "--output-signature=${signature}"
      - "${artifact}"
      - "--yes" # needed on cosign 2.0.0+
    stdin: "{{ .Env.COSIGN_PWD }}"
    artifacts: checksum

// .github/workflows/release.yml

name: Release

on:
  push:
    tags:

      - "v*.*.*"

permissions:
  contents: write
  packages: write

jobs:
  release_job:
    name: Validate and Release
    runs-on: ubuntu-latest
    steps:
      - name: Set Environment Variables
        run: |
          export GOPRIVATE=github.com/abcd,go.buf.build

      - name: Check-out Source
        uses: actions/checkout@v3
        with:
          fetch-depth: 0            # See: https://goreleaser.com/ci/actions/

      - name: Install Cosign
        uses: sigstore/cosign-installer@main

      - name: Check Cosign installation
        run: cosign version

      - name: Run GoReleaser 
        uses: goreleaser/goreleaser-action@v5
        with:
          # either 'goreleaser' (default) or 'goreleaser-pro'
          distribution: goreleaser
          version: latest
          args: "release --clean"
        env:
          GITHUB_TOKEN: ${{ secrets.GORELEASER_TOKEN }}
          COSIGN_PWD: ${{ secrets.COSIGN_PWD }}

[caarlos0]

Goreleaser isn't creating any artifacts, that's why there is no checksum either.

The artifacts you see there are GitHub defaults.

If you enable goreleaser's source archiving feature, it should do what you want