release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  check:
    name: Check (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
          go-version: stable
          cache: false
      - name: Check formatting
        run: test -z "$(gofmt -l .)"
      - run: go vet ./...
      - run: go test ./...
      - name: Check release scripts
        run: |
          bash -n scripts/release-build.sh
          sh -n scripts/install.sh
          python3 -B -m unittest discover -s scripts/tests -p 'test_*.py' -v

  build:
    needs: check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
          go-version: stable
          cache: false
      - name: Build all release assets
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: bash scripts/release-build.sh "$RELEASE_TAG"
      # actions/upload-artifact v4.6.2
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: release-assets
          if-no-files-found: error
          retention-days: 7
          path: |
            dist/dotctl_linux_amd64
            dist/dotctl_linux_arm64
            dist/dotctl_darwin_amd64
            dist/dotctl_darwin_arm64
            dist/checksums.txt
            dist/install.sh

  publish:
    if: github.repository == 'srctl/dotctl'
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      # actions/download-artifact v4.3.0
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: release-assets
          path: dist
      - name: Upload to draft, verify completeness, then publish
        working-directory: dist
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: srctl/dotctl
          RELEASE_TAG: ${{ github.ref_name }}
        shell: bash
        run: |
          set -euo pipefail
          assets=(
            dotctl_linux_amd64 dotctl_linux_arm64
            dotctl_darwin_amd64 dotctl_darwin_arm64 checksums.txt install.sh
          )
          for asset in "${assets[@]}"; do
            test -s "$asset"
          done
          sha256sum --check checksums.txt
          # Fail rather than overwrite any existing release. A failed upload
          # leaves a draft for inspection; delete that draft before rerunning.
          url="https://github.com/srctl/dotctl/blob/$RELEASE_TAG/CHANGELOG.md"
          notes="See the [changelog]($url) for changes and migration notes."
          if [[ "$RELEASE_TAG" == v0.1.0 ]]; then
            migration="Breaking: dotctl update now updates the binary;"
            migration+=" use dotctl save to commit dotfile edits."
            migration+=" Pull is now fast-forward-only."
            notes="$migration $notes"
          fi
          gh release create "$RELEASE_TAG" --verify-tag --draft \
            --title "$RELEASE_TAG" --notes "$notes" --generate-notes
          gh release upload "$RELEASE_TAG" "${assets[@]}"
          expected=$(printf '%s\n' "${assets[@]}" | LC_ALL=C sort)
          actual=$(gh release view "$RELEASE_TAG" --json assets \
            --jq '[.assets[].name] | sort | join("\n")')
          test "$actual" = "$expected"
          gh release edit "$RELEASE_TAG" --draft=false --latest