release.yml

name: Release

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'

permissions:
  contents: read

jobs:
  goreleaser:
    name: GoReleaser
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Let goreleaser read older tags, which it needs for the changelog.
          fetch-depth: 0
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: 'go.mod'
          cache: true
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          version: v2.18.2
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Publishes the image for the same tag. Separate job so a failing image build does
  # not take the archives down with it.
  image:
    name: Image
    needs: [ goreleaser ]
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/build-image.yml
    with:
      version: ${{ github.ref_name }}

  # Separate job for the same reason as the image.
  homebrew:
    name: Homebrew
    needs: [ goreleaser ]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Mint a token for the tap
        id: token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.HOMEBREW_TAP_APP_CLIENT_ID }}
          private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}
          owner: meshcloud
          repositories: homebrew-tap
          permission-contents: write

      - name: Push the formula to the tap
        env:
          # Read through the environment, for the same reason as in build-image.yml.
          TAG: ${{ github.ref_name }}
          GH_TOKEN: ${{ github.token }}
          TAP_TOKEN: ${{ steps.token.outputs.token }}
          APP_SLUG: ${{ steps.token.outputs.app-slug }}
        run: |
          gh release download "$TAG" --pattern '*_SHA256SUMS' --dir "$RUNNER_TEMP/release"

          tap="$RUNNER_TEMP/tap"
          git clone "https://x-access-token:${TAP_TOKEN}@github.com/meshcloud/homebrew-tap.git" "$tap"
          mkdir -p "$tap/Formula"
          .github/homebrew/formula.sh "$TAG" "$RUNNER_TEMP"/release/*_SHA256SUMS > "$tap/Formula/meshstack-cli.rb"

          # Committed as the app's bot user, which is how GitHub attributes a commit to an app.
          bot="${APP_SLUG}[bot]"
          git -C "$tap" config user.name "$bot"
          git -C "$tap" config user.email "$(gh api "/users/${bot}" --jq .id)+${bot}@users.noreply.github.com"

          git -C "$tap" add Formula/meshstack-cli.rb
          # A re-run of this job for the same tag finds nothing to commit.
          if git -C "$tap" diff --cached --quiet; then
            exit 0
          fi
          git -C "$tap" commit -m "meshstack-cli ${TAG#v}"
          git -C "$tap" push origin HEAD:main