release.yaml

name: Publish Release

on:
  push:
    tags:
      - 'v*.*.*'
      - '!v*.*.*-*'  # Exclude pre-releases
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g., v1.0.0)'
        required: true
        type: string

jobs:
  determine-version:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      version: ${{ env.VERSION }}
      changelog_body: ${{ env.CHANGELOG_BODY }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Extract version from tag
        id: get_version
        run: |
          # Get version from tag (either from push event or manual input)
          if [ "${{ github.event_name }}" = "push" ]; then
            VERSION="${{ github.ref_name }}"
          else
            VERSION="${{ inputs.tag }}"
          fi

          # Validate version format using make target
          make validate-release-tag VERSION="$VERSION"

          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
          echo "Release version: $VERSION"

      - name: Validate CHANGELOG has version section
        run: make validate-changelog-has-version VERSION="${{ env.VERSION }}"

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: 'go.mod'

      - name: Extract changelog for release
        id: changelog
        run: |
          VERSION="${{ env.VERSION }}"
          # Extract the specific version section from CHANGELOG.md using make target
          CHANGELOG_CONTENT=$(make extract-changelog-version VERSION="$VERSION")

          # Save to environment variable, handling multiline content
          {
            echo 'CHANGELOG_BODY<<EOF'
            echo "$CHANGELOG_CONTENT"
            echo 'EOF'
          } >> "$GITHUB_ENV"

      - name: Run tests
        run: make test

      - name: Create or update release
        run: |
          VERSION="${{ env.VERSION }}"

          # Check if release already exists
          if gh release view "$VERSION" >/dev/null 2>&1; then
            echo "Release $VERSION already exists, checking if changelog needs to be updated..."

            # Get current release notes
            CURRENT_NOTES=$(gh release view "$VERSION" --json body -q .body)

            # Check if changelog content is already in the notes
            if echo "$CURRENT_NOTES" | grep -qF "${{ env.CHANGELOG_BODY }}"; then
              echo "Changelog already present in release notes, skipping update..."
            else
              echo "Appending changelog to existing release notes..."
              NEW_NOTES="${CURRENT_NOTES}\n\n---\n\n${{ env.CHANGELOG_BODY }}"
              gh release edit "$VERSION" --notes "$NEW_NOTES"
            fi
          else
            echo "Creating release $VERSION..."
            gh release create "$VERSION" \
              --title "$VERSION" \
              --notes "${{ env.CHANGELOG_BODY }}" \
              --latest
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-and-upload:
    needs: determine-version
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write  # Permission for keyless signing
    strategy:
      matrix:
        goos: [linux, windows, darwin]
        goarch: [amd64, arm64]
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: 'go.mod'

      - name: Install cosign
        uses: sigstore/cosign-installer@v4.0.0

      - name: Build release artifacts
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          VERSION: ${{ needs.determine-version.outputs.version }}
        run: make build-release package-release

      - name: Sign release artifacts
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
        run: make sign-release

      - name: Upload assets to release
        run: make upload-release-assets VERSION="${{ needs.determine-version.outputs.version }}"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}