release.yml

# SPDX-License-Identifier: Apache-2.0
# tg ships no image -- consumers resolve it through the Go module proxy from the
# tag. This publishes the GitHub Release that says what a tag contains, so a bot
# author bumping the dependency can read it without opening the changelog.
name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

jobs:
  release:
    name: Verify the tag and publish the release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Require the tag on the branch its channel is published from
        # docs/versioning.md: pre-releases are tagged on dev, stable releases on
        # main. A stable tag that never went through main would publish
        # something the production branch has not seen.
        run: |
          if printf '%s' "${GITHUB_REF_NAME}" | grep -Eq -- '-(alpha|beta|rc)\.'; then
            branch=dev
          else
            branch=main
          fi
          git fetch --no-tags origin "${branch}:refs/remotes/origin/${branch}"
          if ! git merge-base --is-ancestor "${GITHUB_SHA}" "origin/${branch}"; then
            echo "tag ${GITHUB_REF_NAME} is not an ancestor of origin/${branch}"
            exit 1
          fi

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26"
          check-latest: true

      - name: Verify, vet and test
        run: |
          go mod verify
          test -z "$(gofmt -l .)" || (gofmt -l . && exit 1)
          go vet ./...
          go test -race ./...

      - name: Vulnerability scan
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

      - name: Extract changelog section
        id: changelog
        run: |
          version="${GITHUB_REF_NAME}"
          notes_file="$(mktemp)"
          # Match by literal prefix AND a boundary, so "## v0.0.1" does not
          # capture "## v0.0.1-alpha.1".
          awk -v ver="## ${version}" '
            index($0, ver) == 1 && (length($0) == length(ver) || substr($0, length(ver) + 1, 1) == " ") { capture=1; next }
            capture && /^## / { exit }
            capture { print }
          ' CHANGELOG.md >"${notes_file}"
          if [ ! -s "${notes_file}" ]; then
            echo "CHANGELOG.md has no '## ${version}' section"
            exit 1
          fi
          echo "file=${notes_file}" >>"$GITHUB_OUTPUT"

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          flags=""
          if printf '%s' "${GITHUB_REF_NAME}" | grep -Eq -- '-(alpha|beta|rc)\.'; then
            flags="--prerelease"
          fi
          if gh release view "${GITHUB_REF_NAME}" >/dev/null 2>&1; then
            gh release edit "${GITHUB_REF_NAME}" \
              --title "${GITHUB_REF_NAME}" \
              --notes-file "${{ steps.changelog.outputs.file }}" ${flags}
          else
            gh release create "${GITHUB_REF_NAME}" \
              --title "${GITHUB_REF_NAME}" \
              --notes-file "${{ steps.changelog.outputs.file }}" ${flags}
          fi