release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'

# Workflow default is read-only. Only the release job needs write access to
# create the GitHub Release, and that is granted per-job below.
permissions:
  contents: read

jobs:
  release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    permissions:
      contents: write # required by `gh release create` to publish the release
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Verify build
        run: go build ./...

      - name: Run tests
        run: go test -race ./...

      - name: Create Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Idempotent: if the maintainer already published the release
          # manually (with curated notes from CHANGELOG.md), skip the
          # auto-generated fallback. Otherwise create it so tags pushed
          # directly never lack a published release.
          if gh release view "${GITHUB_REF_NAME}" >/dev/null 2>&1; then
            echo "Release ${GITHUB_REF_NAME} already exists — leaving the maintainer-curated notes in place."
            exit 0
          fi
          gh release create "${GITHUB_REF_NAME}" \
            --title "${GITHUB_REF_NAME}" \
            --generate-notes \
            --verify-tag