release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'
      - '!**-rc*'  # exclude pre-releases
  workflow_dispatch:

permissions:
  contents: write
  packages: write
  id-token: write
  attestations: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  goreleaser:
    name: GoReleaser (final publish)
    runs-on: ubuntu-latest
    if: contains(github.ref_name, '-') == false

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.24.x'
          cache: true

      - name: Install git-cliff
        uses: taiki-e/install-action@v2
        with:
          tool: git-cliff

      - name: Compute previous stable (exclude RCs)
        id: base
        shell: bash
        run: |
          # Current tag is the newest stable that triggered this workflow.
          # Get the previous stable (no "-rc") by taking the 2nd most recent stable tag.
          PREV_STABLE=$(git tag --list 'v*' --sort=-v:refname | grep -v -- '-rc' | sed -n '2p' || true)
          if [ -z "$PREV_STABLE" ]; then
            echo "tag=" >> $GITHUB_OUTPUT
          else
            echo "tag=$PREV_STABLE" >> $GITHUB_OUTPUT
          fi

      - name: Generate release notes (since previous stable) to temp
        id: notes
        shell: bash
        run: |
          NOTES_FILE="${RUNNER_TEMP}/RELEASE_NOTES.md"
          TARGET_TAG="${GITHUB_REF_NAME}"
          BASE_TAG="${{ steps.base.outputs.tag }}"
          if [ -n "$BASE_TAG" ]; then
            git-cliff $BASE_TAG..$TARGET_TAG > "$NOTES_FILE"
          else
            git-cliff --tag "$TARGET_TAG" > "$NOTES_FILE"
          fi
          echo "file=$NOTES_FILE" >> "$GITHUB_OUTPUT"
          echo "==== RELEASE NOTES PREVIEW ===="
          head -n 60 "$NOTES_FILE" || true

      - name: Ensure go.mod/go.sum are tidy
        shell: bash
        run: |
          go mod tidy
          if ! git diff --quiet -- go.mod go.sum; then
            echo "::error ::go.mod/go.sum changed after 'go mod tidy'. Commit these changes."
            git --no-pager diff -- go.mod go.sum
            exit 1
          fi

      - name: Fail if git tree is dirty (pre-release)
        shell: bash
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "::error ::Working tree is dirty just before GoReleaser:"
            git status --porcelain
            exit 1
          fi

      - uses: docker/setup-buildx-action@v3
        with:
          install: true

      - name: Log into GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: GoReleaser (publish)
        uses: goreleaser/goreleaser-action@v6
        with:
          version: "~> v2"
          args: release --clean --release-notes="${{ steps.notes.outputs.file }}"
        env:
          GOFLAGS: -mod=readonly
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}