release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  packages: write

jobs:
  test:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Run tests
        run: go test ./... -v

  release:
    needs: [test]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          version: "~> v2"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  dispatch-docsite:
    needs: [release]
    runs-on: ubuntu-latest
    steps:
      - name: Mint app token for api-specs
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.APP_CLIENT_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: Bandwidth
          repositories: api-specs

      - name: Trigger docsite CLI reference update
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          gh api repos/Bandwidth/api-specs/dispatches \
            -f event_type=cli-docs-update \
            -F client_payload[version]="${{ github.ref_name }}"

  bump-formula:
    needs: [release]
    runs-on: ubuntu-latest
    steps:
      - name: Bump Homebrew formula
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          VERSION: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          TAP="Bandwidth/homebrew-tap"
          FORMULA="Formula/band.rb"
          URL="https://github.com/Bandwidth/cli/archive/refs/tags/${VERSION}.tar.gz"

          # Checksum the exact archive brew downloads: curl follows GitHub's redirect
          # to codeload, so this sha256 always matches the formula url's payload.
          SHA="$(curl -fsSL "$URL" | sha256sum | cut -d' ' -f1)"

          git clone "https://x-access-token:${GH_TOKEN}@github.com/${TAP}.git" tap
          cd tap
          sed -i -E "s|^(\s*url ).*|\1\"${URL}\"|" "$FORMULA"
          sed -i -E "s|^(\s*sha256 ).*|\1\"${SHA}\"|" "$FORMULA"

          if git diff --quiet; then
            echo "Formula already at ${VERSION}; nothing to bump."
            exit 0
          fi

          BRANCH="bump-band-${VERSION}"
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git switch -C "$BRANCH"
          git commit -am "band ${VERSION}"
          git push -f origin "$BRANCH"

          # Re-run safe: only open a PR if one isn't already open for this branch.
          if [ -z "$(gh pr list --repo "$TAP" --head "$BRANCH" --state open --json number --jq '.[0].number')" ]; then
            gh pr create --repo "$TAP" --base main --head "$BRANCH" \
              --title "band ${VERSION}" \
              --body "Automated formula bump to ${VERSION}."
          fi