release.yml

name: Publish GitHub Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  release:
    name: Validate Tag and Publish Release
    runs-on: ubuntu-latest

    steps:
      - name: Checkout tagged source
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Validate tag and version metadata
        shell: bash
        run: |
          set -euo pipefail
          version="${GITHUB_REF_NAME#v}"
          tag_ref="refs/tags/$GITHUB_REF_NAME"
          test "$(git cat-file -t "$tag_ref")" = "tag"
          test "$(git rev-parse "$tag_ref^{commit}")" = "$(git rev-parse origin/main)"

          manifest_version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n 1)"
          lock_version="$(awk '$0 == "name = \"algobuddy\"" { getline; gsub(/^version = \"|\"$/, ""); print; exit }' Cargo.lock)"
          test "$version" = "$manifest_version"
          test "$version" = "$lock_version"
          grep -q "^## \[$version\]" CHANGELOG.md

      - name: Extract changelog section
        shell: bash
        run: |
          set -euo pipefail
          version="${GITHUB_REF_NAME#v}"
          awk -v version="$version" '
            $0 ~ "^## \\[" version "\\]" { found = 1; next }
            found && /^## \[/ { exit }
            found { print }
          ' CHANGELOG.md > release-notes.md
          test -s release-notes.md

      - name: Publish GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "$GITHUB_REF_NAME" \
            --verify-tag \
            --title "AlgoBuddy $GITHUB_REF_NAME" \
            --notes-file release-notes.md