release.yml

name: Release

on:
  push:
    tags:
    - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to release (e.g. v0.2.0)'
        required: true
        type: string
      dry_run:
        description: 'Skip publishing (dry run)'
        required: false
        type: boolean
        default: true

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      attestations: write
    steps:
    - name: Checkout the code
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      with:
        fetch-depth: 0
    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version-file: go.mod
        cache-dependency-path: go.sum
    - name: Resolve tag
      id: resolve_tag
      run: |
        echo "tag=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_OUTPUT"
        if [[ "${{ github.event.inputs.dry_run }}" == "true" ]]; then
          echo "extra_flags=--snapshot" >> "$GITHUB_OUTPUT"
        fi
    - name: Verify changie release notes exist
      run: |
        if [ ! -f "changes/${{ steps.resolve_tag.outputs.tag }}.md" ]; then
          echo "::error::Changie fragment changes/${{ steps.resolve_tag.outputs.tag }}.md not found."
          echo "::error::Run 'changie batch ${{ steps.resolve_tag.outputs.tag }}' and 'changie merge' before pushing the tag."
          exit 1
        fi
    - name: Set up Docker Buildx
      if: ${{ github.event.inputs.dry_run != 'true' }}
      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
    - name: Login to GitHub Container Registry
      if: ${{ github.event.inputs.dry_run != 'true' }}
      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Execute GoReleaser
      uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8  # goreleaser-action v7
      with:
        distribution: goreleaser
        version: "~> v2"
        args: release --clean ${{ steps.resolve_tag.outputs.extra_flags }} --release-notes changes/${{ steps.resolve_tag.outputs.tag }}.md
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Upload assets
      if: ${{ github.event.inputs.dry_run != 'true' }}
      uses: actions/upload-artifact@v7
      with:
        name: devcloud
        path: dist/*