name: release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write
  # Required to push container images to ghcr.io.
  packages: write

jobs:
  goreleaser:
    name: goreleaser
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Test
        run: go test ./... -race -cover

      # Required by the `sboms` section of .goreleaser.yml.
      - name: Install syft
        uses: anchore/sbom-action/download-syft@v0

      # dockers_v2 builds multi-platform images with buildx. QEMU provides the
      # arm64 emulation the runner lacks; buildx provides a builder capable of
      # producing a multi-platform manifest.
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Release
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Publishing the Homebrew cask writes to adedayo/homebrew-tap, which
          # the default GITHUB_TOKEN cannot reach: it is scoped to this
          # repository only. Needs contents:write on the tap repository.
          #
          # Falls back to PAT_TOKEN, matching checkmate's releaser.yaml, so
          # whichever of the two secrets already exists is used.
          #
          # When neither is set this is empty, and .goreleaser.yml skips the
          # cask rather than failing the release.
          HOMEBREW_GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_TOKEN || secrets.PAT_TOKEN }}
          # Publishing to winget is two operations against two different
          # repositories: push a branch to the fork (adedayo/winget-pkgs), then
          # open a pull request on the upstream (microsoft/winget-pkgs).
          #
          # This *must* be a classic PAT carrying the `public_repo` scope. A
          # fine-grained token cannot do it, however its permissions are set:
          # such a token only acts on repositories owned by the accounts it was
          # scoped to, so the push to the fork succeeds and the pull request on
          # microsoft/winget-pkgs comes back as
          #   403 Resource not accessible by personal access token
          # which is exactly how the v1.1.1 release failed.
          #
          # There is deliberately no fallback to PAT_TOKEN or
          # HOMEBREW_GITHUB_TOKEN here: those are fine-grained, and inheriting
          # them would reintroduce that failure at the very last step of a
          # release, after everything else has already published. When
          # WINGET_GITHUB_TOKEN is unset this is empty, and .goreleaser.yml
          # skips the winget pipe rather than failing the release.
          WINGET_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}