release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-24.04
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '1.21.13'
          cache-dependency-path: go.mod
      - name: Verify release identity
        run: |
          tag_version="${GITHUB_REF_NAME#v}"
          test "$GITHUB_REF_NAME" = "v$tag_version"
          test "$tag_version" = "$(tr -d '\n' < VERSION)"
          printf '%s' "$tag_version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'
      - name: Run checks
        run: make verify
      - name: Build release artifacts
        run: VERSION="${GITHUB_REF_NAME#v}" make dist
      - name: Verify checksums and smoke Linux AMD64
        run: |
          (cd dist && sha256sum --check SHA256SUMS)
          mkdir -p "$RUNNER_TEMP/code-converge-smoke"
          tar -xzf "dist/code-converge_${GITHUB_REF_NAME#v}_linux_amd64.tar.gz" -C "$RUNNER_TEMP/code-converge-smoke"
          test "$(HOME="$RUNNER_TEMP/code-converge-home" "$RUNNER_TEMP/code-converge-smoke/code-converge" --version)" = "code-converge v${GITHUB_REF_NAME#v}"
          HOME="$RUNNER_TEMP/code-converge-home" "$RUNNER_TEMP/code-converge-smoke/code-converge" config
      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "$GITHUB_REF_NAME" dist/*.tar.gz dist/SHA256SUMS --verify-tag --generate-notes