release.yml

name: Release
on:
  push:
    tags:
      - 'v*'
permissions:
  contents: write
  packages: write
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - uses: GoCodeAlone/setup-wfctl@v1
        with:
          version: v0.63.2
      - name: Validate plugin contract for publish (pre-build)
        run: wfctl plugin validate-contract --for-publish --tag "${{ github.ref_name }}" .
      - uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Verify shipped plugin.json carries tag (post-build)
        run: |
          if [ -f .release/plugin.json ]; then
            wfctl plugin validate-contract --for-publish --tag "${{ github.ref_name }}" --release-dir .release .
          else
            wfctl plugin validate-contract --for-publish --tag "${{ github.ref_name }}" --release-dir . .
          fi
      # workflow#765: runtime truth-check via plugin verify-capabilities.
      # Spawns the built plugin binary, calls PluginService.GetManifest via raw gRPC,
      # diffs Name + Version against plugin.json. Catches ldflag-missing bug where
      # validate-contract (static) passes but binary surfaces sentinel "(devel) [@ sha]".
      - name: Verify capabilities (runtime truth-check)
        run: |
          RUNNER_ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
          BIN=$(jq -r --arg arch "$RUNNER_ARCH" \
            '[.[] | select(.type=="Binary" and .goos=="linux" and .goarch==$arch and (.name|startswith("workflow-plugin-crypto")))] | .[0].path // ""' \
            dist/artifacts.json)
          if [ -z "$BIN" ] || [ "$BIN" = "null" ]; then
            echo "::warning::No matching linux/$RUNNER_ARCH workflow-plugin-crypto binary in dist/artifacts.json; skipping verify-capabilities"
            jq '.[] | {name, type, goos, goarch, path}' dist/artifacts.json
            exit 0
          fi
          wfctl plugin verify-capabilities --binary "$BIN" .
      - name: Publish GitHub release
        if: ${{ success() }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release edit "${{ github.ref_name }}" --draft=false --repo "${{ github.repository }}"

  runtime-image:
    runs-on: ubuntu-latest
    needs: release
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - name: Build ethereum validator reward runner binary
        run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-s -w -X github.com/GoCodeAlone/workflow-plugin-crypto/internal/validatorreward.Version=${{ github.ref_name }}" -o docker/ethereum-validator-reward/ethereum-validator-reward-runner ./cmd/ethereum-validator-reward-runner
      - name: Login to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push ethereum validator reward image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/ethereum-validator-reward/Dockerfile
          push: true
          tags: ghcr.io/gocodealone/workflow-plugin-crypto/ethereum-validator-reward-runner:${{ github.ref_name }}
      - name: Report runtime image digest
        run: echo "ethereum validator reward runtime image digest ${{ steps.build.outputs.digest }}"