Merge release-please and release-binaries workflows

.github/workflows/release-please.yml

@@ -12,22 +12,81 @@ name: release-please
 jobs:
   release-please:
     runs-on: ubuntu-latest
-    steps:
-      - id: get-secrets
-        uses: grafana/shared-workflows/actions/get-vault-secrets@main
-        with:
-          repo_secrets: |
-            TANKABOT_APP_ID=tankabot_app:id
-            TANKABOT_APP_PRIVATE_KEY=tankabot_app:private_key
+    outputs:
+      release_created: "${{ steps.release-please.outputs.release_created }}"
+      release_tag: "${{ steps.release-please.outputs.tag_name }}"
 
-      - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
-        id: app-token
+    steps:
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
         with:
-          app-id: ${{ env.TANKABOT_APP_ID }}
-          private-key: ${{ env.TANKABOT_APP_PRIVATE_KEY }}
+          # https://github.com/actions/checkout/issues/1467 
+          fetch-depth: 0
 
       - uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3
+        id: release-please
         with:
           config-file: .release-please.json
           manifest-file: .release-please-manifest.json
-          github-token: ${{ steps.app-token.outputs.token }}
+          github-token: ${{ github.secret }}
+
+  # If a release was created, also create the binaries and attach them
+  release-binaries:
+    runs-on: ubuntu-latest
+    needs:
+      - release-please
+    if: needs.release-please.outputs.release_created
+
+    steps:
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        with:
+          # https://github.com/actions/checkout/issues/1467 
+          fetch-depth: 0
+          ref: "${{ needs.release-please.outputs.release_tag }}"
+
+      - name: Look up release
+        id: lookup-release
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const currentTag = "${{ needs.release-please.outputs.release_tag }}";
+            core.info(`Looking for release associated with '${currentTag}'`);
+            const release = await github.rest.repos.getReleaseByTag({owner: context.repo.owner, repo: context.repo.repo, tag: currentTag});
+            core.info(`Release found: ${release.data.id}'`);
+            core.setOutput('release_id', release.data.id);
+
+
+      - uses: ./.github/actions/setup-goversion
+
+      - name: Build binaries
+        run: make cross
+
+      - name: Attach binaries
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          github-token: ${{ github.token }}
+          script: |
+            const path = require('node:path');
+            const fs = require('node:fs/promises');
+
+            const releaseId = '${{ steps.lookup-release.outputs.release_id }}';
+            const globber = await glob.create('dist/*');
+
+            for await (const file of globber.globGenerator()) {
+              const filename = path.basename(file);
+              try {
+                await github.rest.repos.uploadReleaseAsset({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  release_id: releaseId,
+                  name: filename,
+                  data: await fs.readFile(file),
+                });
+              } catch (e) {
+                if (e.status === 422) {
+                  core.setFailed(`${filename} already attached to release`);
+                  return;
+                }
+                throw e;
+              }
+            }
+