cli-release.yml

name: CLI – Release

# Trigger: push a tag of the form cli/vX.Y.Z
# Examples:
#   git tag cli/v1.0.0 && git push origin cli/v1.0.0
on:
    push:
        tags:
            # Require a numeric version immediately after the prefix so that
            # accidental tags like cli/vtest or cli/vfoo never trigger a release.
            - "cli/v[0-9]*"

# Guard: only proceed when the tag is reachable from master/main.
# This prevents a cli/v* tag pushed on a feature branch from publishing a release.
# The check runs as the very first step in each job via job-level `if`.
# github.event.base_ref is the branch the tag points to when pushed via
# `git push origin <tag>`; for annotated tags it may be empty, so we also
# perform an explicit ancestry check inside the changelog job.

# Least-privilege: default to read-only; the release job escalates below.
permissions:
    contents: read

jobs:
    # -------------------------------------------------------------------------
    # 1. Generate the CLI-only changelog
    # -------------------------------------------------------------------------
    changelog:
        name: Generate Changelog
        runs-on: ubuntu-latest
        outputs:
            prev_tag: ${{ steps.prev_tag.outputs.tag }}

        steps:
            - name: Checkout
              uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
              with:
                  fetch-depth: 0

            - name: Verify tag is on master/main
              shell: bash
              run: cli/scripts/verify-tag-on-main.sh

            - name: Resolve previous CLI tag
              id: prev_tag
              shell: bash
              run: |
                  PREV=$(cli/scripts/resolve-prev-tag.sh)
                  echo "Previous tag: ${PREV}"
                  echo "tag=${PREV}" >> "$GITHUB_OUTPUT"

            - name: Generate changelog
              id: gen
              shell: bash
              run: |
                  NOTES_FILE="${RUNNER_TEMP}/cli-changelog.md"
                  PREV_TAG="${{ steps.prev_tag.outputs.tag }}"
                  CURRENT_TAG="${GITHUB_REF_NAME}"

                  bash cli/scripts/generate-changelog.sh "${PREV_TAG}" "${CURRENT_TAG}" \
                    > "${NOTES_FILE}"

                  echo "--- Generated changelog ---"
                  cat "${NOTES_FILE}"
                  echo "---"
                  echo "notes_file=${NOTES_FILE}" >> "$GITHUB_OUTPUT"

            - name: Upload changelog artifact
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
              with:
                  name: cli-changelog
                  path: ${{ steps.gen.outputs.notes_file }}
                  retention-days: 1

    # -------------------------------------------------------------------------
    # 2. Run tests before cutting a release
    # -------------------------------------------------------------------------
    test:
        name: Test
        runs-on: ubuntu-latest
        defaults:
            run:
                working-directory: cli

        steps:
            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

            - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
              with:
                  go-version-file: cli/go.mod
                  cache: true
                  cache-dependency-path: cli/go.sum

            - name: Install gotestfmt
              uses: gotesttools/gotestfmt-action@eba2ac97f623e866e7b1b117c99f18b43cd36d18 # v2.3.0
              with:
                  token: ${{ secrets.GITHUB_TOKEN }}

            - name: Run tests
              run: |
                  set -euo pipefail
                  go test -race -json -v ./... 2>&1 | tee /tmp/gotest.log | gotestfmt

    # -------------------------------------------------------------------------
    # 3. GoReleaser – build binaries and publish the GitHub Release
    # -------------------------------------------------------------------------
    release:
        name: Release
        runs-on: ubuntu-latest
        needs: [changelog, test]
        permissions:
            contents: write

        steps:
            - name: Checkout
              uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
              with:
                  fetch-depth: 0

            - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
              with:
                  go-version-file: cli/go.mod
                  cache: true
                  cache-dependency-path: cli/go.sum

            - name: Download changelog artifact
              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
              with:
                  name: cli-changelog
                  path: ${{ runner.temp }}

            - name: Resolve bare version
              id: version
              shell: bash
              run: |
                  # Strip "cli/v" to get bare semver (e.g. cli/v1.2.3 → 1.2.3).
                  # Used as VERSION in GoReleaser templates for archive names and ldflags.
                  echo "value=${GITHUB_REF_NAME#cli/v}" >> "$GITHUB_OUTPUT"

            - name: Run GoReleaser
              uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
              with:
                  distribution: goreleaser
                  version: "~> v2"
                  # Config lives inside cli/ but GoReleaser runs from the repo root
                  # so that git commands resolve correctly.
                  args: >-
                      release
                      --config cli/.goreleaser.yml
                      --release-notes "${{ runner.temp }}/cli-changelog.md"
                      --clean
                      --skip=validate
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  # Full cli/vX.Y.Z tag → GoReleaser publishes the GitHub Release under this tag.
                  GORELEASER_CURRENT_TAG: ${{ github.ref_name }}
                  # Bare version (e.g. 1.2.3) → referenced as {{ .Env.VERSION }} in
                  # .goreleaser.yml for archive names, ldflags, and checksum filenames.
                  VERSION: ${{ steps.version.outputs.value }}