release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  packages: write

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history required for changelog generation

      - name: Verify tag is on main
        run: |
          git fetch origin main
          if ! git merge-base --is-ancestor HEAD origin/main; then
            echo "Tag v${{ github.ref_name }} is not an ancestor of main — refusing release."
            exit 1
          fi

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Install nfpm dependencies
        run: sudo apt-get install -y rpm

      - name: Run tests
        run: CGO_ENABLED=0 go test -p 1 -count=1 ./...

      - name: Log in to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AUR_KEY: ${{ secrets.AUR_KEY }}
          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}

      - name: Push to AUR
        run: scripts/aur-push.sh
        env:
          AUR_KEY: ${{ secrets.AUR_KEY }}

      - name: Wait for propagation
        run: sleep 150