From 85b7248e1aaede42bdd88a95db2c4e39e10a2589 Mon Sep 17 00:00:00 2001
From: ttyS3 <41882455+ttys3@users.noreply.github.com>
Date: Fri, 4 Sep 2026 03:13:48 +0000
Subject: [PATCH] ci: fix GoReleaser pull request workflow

Run snapshot releases with read-only permissions for pull requests and reserve write-enabled releases for tags. Upgrade CI to Go 1.27.1 and GoReleaser Action v7 with CLI v2.

Co-Authored-By: Codex (gpt-5.6-sol) <noreply@openai.com>
---
 .github/workflows/release.yml | 44 +++++++++++++++++++++++++----------
 1 file changed, 32 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a7efe61..ed7d2c3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,12 +9,11 @@ on:
       - "*"
 
 permissions:
-  contents: write
-  # packages: write
-  # issues: write
+  contents: read
 
 jobs:
   goreleaser:
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -24,18 +23,39 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: stable
-      # More assembly might be required: Docker logins, GPG, etc.
-      # It all depends on your needs.
+          go-version: "1.27.1"
+      - name: Run tests
+        run: go test -race ./...
+      - name: Run GoReleaser snapshot
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --snapshot --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/')
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.27.1"
+      - name: Run tests
+        run: go test -race ./...
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v7
         with:
-          # either 'goreleaser' (default) or 'goreleaser-pro'
           distribution: goreleaser
-          # 'latest', 'nightly', or a semver
-          version: "~> v1"
+          version: "~> v2"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Your GoReleaser Pro key, if you are using the 'goreleaser-pro' distribution
-          # GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}