goreleaser.yml

name: goreleaser
on:
  push:
    tags:
      - "*"
  # Rebuild an existing tag's images with the current Go toolchain (e.g. CVE
  # fix in Go). GitHub release assets are pinned, so binaries stay as-is.
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to rebuild and re-release (e.g. v0.5.0); empty = latest tag"
        required: false
        default: ""
  # Weekly image refresh of the latest tag with the current Go toolchain;
  # schedules only run on the default branch.
  schedule:
    - cron: "0 3 * * 0"
# Creates the GitHub release and pushes the container images.
permissions:
  contents: write
  packages: write
jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || '' }}
      - name: Check out latest tag
        if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.tag == '')
        run: git checkout "$(git tag --sort=-v:refname | head -n1)"
      - name: Rebuild the container images only
        # GitHub release assets are pinned: a rebuild refreshes images, never
        # binaries. GoReleaser refuses a dirty checkout, and even an untracked
        # file counts, so the tag's frozen config is rewritten outside the
        # tree. An older tag must not drag the major.minor/latest tags back.
        if: github.event_name != 'push'
        run: |
          cfg="$RUNNER_TEMP/goreleaser.yml"
          cp .goreleaser.yml "$cfg"
          sed -i 's/^release:/release:\n  disable: true/' "$cfg"
          if ! grep -A1 '^release:' "$cfg" | grep -q 'disable: true'; then
            echo "::error::no release section to disable in .goreleaser.yml" >&2
            exit 1
          fi
          latest="$(git tag --sort=-v:refname | head -n1)"
          current="$(git describe --tags --exact-match)"
          if [ "$current" != "$latest" ]; then
            sed -i \
              -e '/{{ \.Major }}\.{{ \.Minor }}/d' \
              -e '/{{ if not \.Prerelease }}latest{{ end }}/d' \
              "$cfg"
            if grep -qE '\.(Major|Minor)|latest' "$cfg"; then
              echo "::error::unrecognized image tag lines in .goreleaser.yml; update the rebuild filter" >&2
              exit 1
            fi
            echo "Rebuilding $current, not the newest tag ($latest); only its exact image tag moves."
          else
            echo "Rebuilding $current, the newest tag; its image tags move, the pinned release does not."
          fi
          echo "GORELEASER_ARGS=--config $cfg" >> "$GITHUB_ENV"
      - name: Resolve the current Go release
        id: pick
        # The go-versions manifest lags fresh releases, but setup-go downloads
        # a version it does not know straight from go.dev, so resolve it here.
        run: |
          pick="$(curl -fsSL 'https://go.dev/VERSION?m=text')"
          pick="${pick%%[[:space:]]*}"
          echo "version=${pick#go}" >> "$GITHUB_OUTPUT"
      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version: ${{ steps.pick.outputs.version }}
      # setup-go exports GOTOOLCHAIN=local via GITHUB_ENV; a later write wins.
      - name: Allow Go toolchain downloads
        run: echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"
      - name: Install Task
        uses: go-task/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Log in to Docker Hub
        # Needs DOCKERHUB_USERNAME and DOCKERHUB_TOKEN repository secrets.
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: latest
          args: release ${{ env.GORELEASER_ARGS }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}