release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  # workflow_dispatch lets us re-run a release manually against an
  # existing tag (e.g. after a transient failure, or when a tag was
  # re-pushed at the same SHA and GitHub deduped the push event).
  # Trigger: `gh workflow run release.yml --ref v0.4.0`
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to release (e.g. v0.4.0). Used for logs only; the actual ref is determined by --ref at dispatch time.'
        required: false
        default: ''

# Visibility lifecycle (ADR-0013 §3):
#   - v0.0.x – v0.3.x: private repo; goreleaser ran with --skip=publish
#     to validate the config without shipping anything externally. The
#     visibility flip happened at the end of Phase 8 (just before v0.4.0).
#   - v0.4.0+: full publish. Binaries land on the GitHub Release page;
#     formulas/manifests go to CommitBrief/homebrew-tap and
#     CommitBrief/scoop-bucket via HOMEBREW_TAP_GITHUB_TOKEN (PAT with
#     repo scope; the default GITHUB_TOKEN cannot write to those repos).

permissions:
  contents: write

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v5
        with:
          go-version: '1.25'

      - name: Pre-release safety checks
        run: bash scripts/release-check.sh

      - name: License audit
        run: bash scripts/license-check.sh

      - uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}