release.yml

name: Release
run-name: "Release ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.release.tag_name }}"

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to release (e.g., v1.0.0)'
        required: true
        type: string

permissions:
  contents: write
  id-token: write

jobs:
  release:
    name: Build and Release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Determine tag
        id: get_tag
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            TAG="${{ inputs.tag }}"
          else
            TAG="${{ github.event.release.tag_name }}"
          fi
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "Using tag: $TAG"

      - name: Ensure tag points to master HEAD (workflow_dispatch only)
        if: github.event_name == 'workflow_dispatch'
        run: |
          TAG="${{ steps.get_tag.outputs.tag }}"
          HEAD_SHA=$(git rev-parse HEAD)

          echo "Tag: $TAG"
          echo "Master HEAD: $HEAD_SHA"

          # Configure git
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          # Check if tag exists
          if git rev-parse "$TAG" >/dev/null 2>&1; then
            TAG_SHA=$(git rev-parse "$TAG")
            echo "Existing tag SHA: $TAG_SHA"

            if [ "$TAG_SHA" = "$HEAD_SHA" ]; then
              echo "Tag already points to HEAD, no update needed"
            else
              echo "Updating tag to point to HEAD..."
              # Delete and recreate tag
              git tag -d "$TAG"
              git push origin ":refs/tags/$TAG" || true
              git tag -a "$TAG" -m "Release $TAG"
              git push origin "$TAG"
              echo "Tag updated successfully"
            fi
          else
            echo "Creating new tag..."
            git tag -a "$TAG" -m "Release $TAG"
            git push origin "$TAG"
            echo "Tag created successfully"
          fi

      - uses: actions/setup-go@v6
        with:
          go-version: '1.25'

      - name: Run tests
        run: go test -v -race ./...

      - name: Install Syft (for SBOM generation)
        uses: anchore/sbom-action/download-syft@v0

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: binaries
          path: dist/*.tar.gz
          retention-days: 5