release.yml

name: Release

# cloudkit is a library: a release is a pair of git tags and a GitHub release
# whose body is the tagged CHANGELOG section. There are no binaries to build,
# so this is the one Go repository that does not call simtabi/.github's shared
# go-release.yml (that workflow runs GoReleaser, and there is nothing for it to
# build here).
#
# A release runs in two ways, and no other:
#
#   git push origin vX.Y.Z                                              releases vX.Y.Z
#   gh workflow run release.yml --repo simtabi/cloudkit -f tag=vX.Y.Z    the same, for a tag already pushed
#
# Push a version tag only for final code: tags are final, and a pushed tag
# releases. src/internal/policy's TestReleaseRunsOnAVersionTagOrOnRequest fails
# if this file gains any other trigger or stops checking out the tag it releases.
#
# The src/vX.Y.Z alias this workflow pushes matches neither tag filter, and a
# tag pushed with the workflow's own token starts no run anyway.
on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-*'
  workflow_dispatch:
    inputs:
      tag:
        description: An existing vX.Y.Z tag to release
        required: true
        type: string

# One run per tag, never cancelled: two runs must not publish the same release.
concurrency:
  group: release-${{ inputs.tag || github.ref_name }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: release
    timeout-minutes: 10
    permissions:
      contents: write # push the src/ alias tag and create the release
    env:
      TAG: ${{ inputs.tag || github.ref_name }}
    steps:
      - name: Check the tag
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          if ! [[ "${TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
            echo "::error::'${TAG}' is not a vX.Y.Z or vX.Y.Z-pre tag; nothing was published"
            exit 1
          fi
          if ! gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG}" --silent; then
            echo "::error::${TAG} is not a tag on ${GITHUB_REPOSITORY}; push it first, a release is made from a tag only"
            exit 1
          fi

      - uses: actions/checkout@v7
        with:
          ref: refs/tags/${{ inputs.tag || github.ref_name }}
          fetch-depth: 0

      # Go resolves a module in a subdirectory only through a tag carrying that
      # prefix, so src/vX.Y.Z must sit on the same commit. Create it if missing;
      # refuse if it exists elsewhere, since tags are final and never moved.
      - name: Module alias tag
        run: |
          alias="src/${TAG}"
          head="$(git rev-parse "${TAG}^{commit}")"
          if git rev-parse -q --verify "refs/tags/${alias}" >/dev/null; then
            at="$(git rev-parse "${alias}^{commit}")"
            if [ "${at}" != "${head}" ]; then
              echo "::error::${alias} points at ${at}, not ${head}; tags are final, cut the next version"
              exit 1
            fi
          else
            git tag "${alias}" "${head}"
            git push origin "refs/tags/${alias}"
          fi

      - name: Release notes from the CHANGELOG section
        run: src/scripts/extract-changelog.sh "${TAG}" > "${RUNNER_TEMP}/notes.md"

      - name: Create or update the GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh release view "${TAG}" >/dev/null 2>&1; then
            gh release edit "${TAG}" --notes-file "${RUNNER_TEMP}/notes.md"
          else
            gh release create "${TAG}" --verify-tag --title "${TAG}" --notes-file "${RUNNER_TEMP}/notes.md"
          fi