release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: Existing semantic-version tag to publish
        required: true
        type: string

permissions: {}

concurrency:
  group: release-${{ inputs.tag || github.ref_name }}
  cancel-in-progress: false

jobs:
  validate:
    name: Validate release tag
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    outputs:
      commit: ${{ steps.release_commit.outputs.sha }}
      tag: ${{ steps.release_commit.outputs.tag }}

    steps:
      - name: Checkout release tag
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          ref: ${{ inputs.tag || github.ref }}

      - name: Validate release tag
        id: release_commit
        shell: bash
        env:
          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
        run: |
          SEMVER_TAG_PATTERN='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-((0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(\.(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*))?(\+([0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*))?$'
          if [[ ! "$RELEASE_TAG" =~ $SEMVER_TAG_PATTERN ]]; then
            echo "Release tag must be semantic and start with v: $RELEASE_TAG" >&2
            exit 1
          fi
          source_version=$(tr -d '\r\n' < internal/version/VERSION)
          if [[ "$RELEASE_TAG" != "v$source_version" ]]; then
            echo "Release tag $RELEASE_TAG does not match source version v$source_version" >&2
            exit 1
          fi
          git show-ref --verify --quiet "refs/tags/$RELEASE_TAG"
          git fetch --no-tags origin main
          if ! git merge-base --is-ancestor "$RELEASE_TAG^{commit}" FETCH_HEAD; then
            echo "Release tag is not reachable from origin/main: $RELEASE_TAG" >&2
            exit 1
          fi
          printf 'sha=%s\n' "$(git rev-parse "$RELEASE_TAG^{commit}")" >> "$GITHUB_OUTPUT"
          printf 'tag=%s\n' "$RELEASE_TAG" >> "$GITHUB_OUTPUT"

  test:
    name: Test ${{ matrix.os }}
    needs: validate
    runs-on: ${{ matrix.os }}
    timeout-minutes: 25
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
      - name: Checkout validated release
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          ref: ${{ needs.validate.outputs.tag }}

      - name: Verify validated commit
        shell: bash
        env:
          EXPECTED_COMMIT: ${{ needs.validate.outputs.commit }}
        run: |
          actual_commit=$(git rev-parse HEAD)
          if [[ "$actual_commit" != "$EXPECTED_COMMIT" ]]; then
            echo "Release tag changed after validation." >&2
            exit 1
          fi

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Setup Bats
        if: runner.os == 'Linux'
        uses: bats-core/bats-action@4.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          support-install: false
          assert-install: false
          detik-install: false
          file-install: false

      - name: Check formatting
        if: runner.os != 'Windows'
        shell: bash
        run: test -z "$(gofmt -l .)"

      - name: Vet
        run: go vet ./...

      - name: Core tests (race and coverage)
        shell: bash
        run: |
          set -o pipefail
          go test -race -cover -json -timeout 10m -skip '^TestLocalisedScreens$' ./... | tee core-test-results.json

      - name: Localised screens (all locales, race and coverage)
        shell: bash
        run: |
          set -o pipefail
          go test -race -cover -json -timeout 10m -run '^TestLocalisedScreens$' ./internal/ui | tee locale-test-results.json

      - name: Preserve test results and timings
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: release-go-tests-${{ matrix.os }}
          path: '*-test-results.json'
          retention-days: 7
          if-no-files-found: ignore

      - name: Build
        run: go build -trimpath ./...

      - name: Test Unix release installer
        if: runner.os == 'Linux'
        run: bats test/install-release.bats

      - name: Test Windows release installer (PowerShell 7)
        if: runner.os == 'Windows'
        shell: pwsh
        run: ./test/install-release.ps1

      - name: Test Windows release installer (Windows PowerShell 5.1)
        if: runner.os == 'Windows'
        shell: powershell
        run: ./test/install-release.ps1

  release:
    name: Build and publish
    needs: [validate, test]
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write

    steps:
      - name: Checkout validated release
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ needs.validate.outputs.tag }}

      - name: Verify validated commit
        shell: bash
        env:
          EXPECTED_COMMIT: ${{ needs.validate.outputs.commit }}
        run: |
          actual_commit=$(git rev-parse HEAD)
          if [[ "$actual_commit" != "$EXPECTED_COMMIT" ]]; then
            echo "Release tag changed after validation." >&2
            exit 1
          fi

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Build and publish GitHub release
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}