# Publish a release when a version tag is pushed: test, check for known
# vulnerabilities, build the Linux binaries, attach them with their checksums.
#
# Tags are the date of the commit, as ihasmail's are: v2026.9.15, and
# v2026.9.15.1 for a second release on the same day.
name: Release

on:
  push:
    tags: ["v*"]
  # For a tag whose run never started. GitHub has queued and then orphaned
  # runs before, and a pushed tag has no other way to trigger this again.
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing tag to release, e.g. v2026.9.15"
        required: true
        type: string

concurrency:
  group: release-${{ github.event.inputs.tag || github.ref_name }}
  cancel-in-progress: false

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    env:
      TAG: ${{ github.event.inputs.tag || github.ref_name }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}
          fetch-depth: 0
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod

      - name: Check the tag names a commit on main
        run: |
          set -euo pipefail
          git fetch --quiet origin main
          git merge-base --is-ancestor "$(git rev-parse "$TAG^{commit}")" origin/main \
            || { echo "::error::$TAG is not on main"; exit 1; }

      - name: Vet and test
        run: |
          go vet ./...
          go test ./...

      - name: Known vulnerabilities
        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

      - name: Build
        run: |
          SOURCE_DATE_EPOCH="$(git log -1 --format=%ct "$TAG")" scripts/build-release.sh "$TAG" dist

      - name: Publish
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          if gh release view "$TAG" >/dev/null 2>&1; then
            gh release upload "$TAG" dist/* --clobber
          else
            gh release create "$TAG" dist/* --verify-tag --title "$TAG" --generate-notes
          fi