release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g., v1.0.0)'
        required: true
        type: string

permissions:
  contents: write

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set release tag
        id: set-tag
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            TAG="${{ github.event.inputs.tag }}"
            echo "Creating tag $TAG"
            git config user.name "github-actions[bot]"
            git config user.email "github-actions[bot]@users.noreply.github.com"
            git tag "$TAG"
            git push origin "$TAG"
          else
            TAG="${{ github.ref_name }}"
          fi
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum

      - name: Verify root module
        run: |
          go mod download
          go mod tidy
          git diff --exit-code go.mod go.sum
          go build ./...
          go test -race -count=1 ./...

      - name: Verify sub-modules
        run: |
          for mod in api sentinel extension integrations/fabriq; do
            echo "::group::Verifying $mod"
            pushd "$mod" > /dev/null
            go mod download
            go mod tidy
            git diff --exit-code go.mod go.sum
            go build ./...
            go test -race -count=1 ./...
            popd > /dev/null
            echo "::endgroup::"
          done

      - name: Tag sub-modules
        run: |
          TAG="${{ steps.set-tag.outputs.tag }}"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          # A sub-module's replace directive is ignored once it is somebody
          # else's dependency, so its require line is what a consumer really
          # resolves. On main that line names the previous release, which is
          # right for local work and wrong for the tag we are cutting: a
          # consumer would get an engine older than the code that needs it.
          # Pin the requires to this tag, commit, and tag that commit.
          #
          # The commit is never pushed to a branch. It is reachable through
          # the sub-module tags alone, so main keeps pointing sub-modules at
          # the last release and stays buildable against the working tree.
          scripts/pin-submodules.sh "$TAG"
          git add api/go.mod sentinel/go.mod extension/go.mod integrations/fabriq/go.mod
          git commit -m "chore: pin sub-modules to $TAG"

          for mod in api sentinel extension integrations/fabriq; do
            MOD_TAG="$mod/$TAG"
            if git rev-parse -q --verify "refs/tags/$MOD_TAG" > /dev/null; then
              echo "$MOD_TAG already exists, skipping"
              continue
            fi
            echo "Tagging $MOD_TAG"
            git tag "$MOD_TAG"
            git push origin "$MOD_TAG"
          done

          git reset --hard HEAD~1

      - name: Verify sub-modules resolve from the proxy
        run: |
          TAG="${{ steps.set-tag.outputs.tag }}"
          # The failure this catches is a sub-module tag whose require names a
          # root version the proxy cannot serve. It looks fine in CI, where the
          # replace hides it, and fails for the first person to run go get.
          PROBE=$(mktemp -d)
          cd "$PROBE"
          go mod init example.com/probe
          for mod in api sentinel extension integrations/fabriq; do
            echo "::group::go get github.com/xraph/cortex/$mod@$TAG"
            GOFLAGS=-mod=mod GOPROXY=proxy.golang.org go get "github.com/xraph/cortex/$mod@$TAG"
            echo "::endgroup::"
          done

      - name: Generate release notes
        id: notes
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
          if [ -z "$PREV_TAG" ]; then
            NOTES=$(git log --pretty=format:"- %s (%h)" HEAD)
          else
            NOTES=$(git log --pretty=format:"- %s (%h)" ${PREV_TAG}..HEAD)
          fi
          {
            echo "notes<<EOF"
            echo "$NOTES"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Create GitHub release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.set-tag.outputs.tag }}
          body: |
            ## Changes

            ${{ steps.notes.outputs.notes }}

            ---

            ### Installation

            ```bash
            go get github.com/xraph/cortex@${{ steps.set-tag.outputs.tag }}
            ```

            The engine is the root module. Everything that pulls a heavy
            dependency ships separately, so take only what you use:

            ```bash
            go get github.com/xraph/cortex/api@${{ steps.set-tag.outputs.tag }}
            go get github.com/xraph/cortex/sentinel@${{ steps.set-tag.outputs.tag }}
            go get github.com/xraph/cortex/extension@${{ steps.set-tag.outputs.tag }}
            go get github.com/xraph/cortex/integrations/fabriq@${{ steps.set-tag.outputs.tag }}
            ```
          generate_release_notes: true