release.yml

name: release

# Two ways to cut a release:
#   1. Merge a PR that bumps VERSION. This workflow tags the merge commit
#      v<VERSION> and builds it. If .github/release-notes/v<VERSION>.md exists,
#      it becomes the release body instead of the generated changelog.
#   2. Push a v* tag by hand, as before.
on:
  push:
    branches: [main]
    paths: [VERSION]
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      # A tag pushed with GITHUB_TOKEN doesn't start another workflow run, so
      # tag and build in this job rather than waiting for the tag trigger.
      - name: tag VERSION bump
        id: tag
        if: github.ref_type == 'branch'
        run: |
          version=$(tr -d '[:space:]' < VERSION)
          if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
            echo "VERSION must be semver like 0.3.0, got '$version'"
            exit 1
          fi
          tag="v$version"
          if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
            echo "$tag already exists; nothing to release."
            echo "skip=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git tag "$tag"
          git push origin "$tag"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"

      - name: release notes
        id: notes
        if: steps.tag.outputs.skip != 'true'
        run: |
          notes=".github/release-notes/${{ steps.tag.outputs.tag || github.ref_name }}.md"
          if [ -f "$notes" ]; then
            echo "args=--release-notes $notes" >> "$GITHUB_OUTPUT"
          fi

      - uses: actions/setup-go@v6
        if: steps.tag.outputs.skip != 'true'
        with:
          go-version: "1.24"
          cache: true

      # Homebrew / Scoop / Winget publishing requires a GitHub App token with
      # write access to the tap/bucket repos. Re-add the following step once
      # those repos and App exist (see .goreleaser.yaml for the setup
      # instructions), and uncomment the matching *_TOKEN env vars below.
      #
      # - name: generate github app token
      #   id: app_token
      #   uses: actions/create-github-app-token@v1
      #   with:
      #     app-id: ${{ secrets.RELEASE_APP_ID }}
      #     private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
      #     owner: HasData

      - uses: goreleaser/goreleaser-action@v6
        if: steps.tag.outputs.skip != 'true'
        with:
          distribution: goreleaser
          version: latest
          args: release --clean ${{ steps.notes.outputs.args }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # HOMEBREW_TAP_TOKEN: ${{ steps.app_token.outputs.token }}
          # SCOOP_BUCKET_TOKEN: ${{ steps.app_token.outputs.token }}
          # WINGET_PKGS_TOKEN: ${{ steps.app_token.outputs.token }}