release.yaml

---
name: Release

on:
  push:
    tags: ['v*']

permissions: {}

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: 'stable'
          check-latest: true

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Prepare Ko
        uses: ko-build/setup-ko@61b4d1d396f5b2e7d6bb6fefdce3dc38d1a13445 # v0.10

      - name: Compute build metadata
        env:
          REVISION: ${{ github.sha }}
        run: |
          {
            echo BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
            echo REVISION="${REVISION}"
            echo VERSION="$(git describe --tags --always)"
          } >> "$GITHUB_ENV"

      - name: Build and publish container image
        env:
          SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}
          ARCHS: amd64,arm64
          IMAGE_TAGS: ${{ github.ref_name }}
        run: make image-build

      - name: Sign container image
        run: cosign sign --yes "$(cat image-ref.out)"

      - name: Extract release notes from CHANGELOG.md
        run: |
          awk -v tag="${GITHUB_REF_NAME}" '
            /^## \[/ { if (index($0, "## [" tag "]") == 1) { found=1; next } else if (found) { exit } }
            found
          ' CHANGELOG.md > release-notes.md
          if [ ! -s release-notes.md ]; then
            echo "Error: No changelog section found for ${GITHUB_REF_NAME} in CHANGELOG.md"
            exit 1
          fi

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "${GITHUB_REF_NAME}" --title "${GITHUB_REF_NAME}" --notes-file release-notes.md