name: release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  id-token: write
  attestations: write
  artifact-metadata: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  goreleaser:
    name: Build And Publish Binaries
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Ensure Tag Commit Is On Default Branch
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          git fetch origin "$DEFAULT_BRANCH" --depth=1
          if ! git merge-base --is-ancestor "$GITHUB_SHA" "origin/$DEFAULT_BRANCH"; then
            echo "tag ${GITHUB_REF_NAME} must reference a commit reachable from ${DEFAULT_BRANCH}"
            exit 1
          fi

      - name: Set Up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: src/go.mod

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: "~> v2"
          workdir: src
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Attest Release Artifacts
        uses: actions/attest@v4
        with:
          subject-checksums: src/dist/SHA256SUMS