release.yml

name: release

# Build cross-platform ccr binaries on a version tag and attach them to the
# GitHub Release. The asset name ccr-<os>-<arch> must stay in lockstep with
# package.json's urlPattern and the Makefile — internal/release asserts this.
on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - { goos: linux, goarch: amd64 }
          - { goos: linux, goarch: arm64 }
          - { goos: darwin, goarch: amd64 }
          - { goos: darwin, goarch: arm64 }
          - { goos: windows, goarch: amd64 }
          - { goos: windows, goarch: arm64 }
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Verify release version
        run: test "$(cat VERSION)" = "${GITHUB_REF_NAME}"

      - name: Build
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: '0'
        run: |
          BIN_NAME=ccr-${{ matrix.goos }}-${{ matrix.goarch }}
          if [ "${{ matrix.goos }}" = "windows" ]; then BIN_NAME="${BIN_NAME}.exe"; fi
          go build \
            -ldflags "-s -w -X main.Version=${GITHUB_REF_NAME} -X main.GitCommit=$(git rev-parse --short HEAD) -X main.BuildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
            -o "dist/${BIN_NAME}" ./cmd/ccr

      - uses: actions/upload-artifact@v4
        with:
          name: ccr-${{ matrix.goos }}-${{ matrix.goarch }}
          path: dist/*
          if-no-files-found: error

  release:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Checksums
        run: cd dist && shasum -a 256 ccr-* | sort > sha256sum.txt

      - uses: softprops/action-gh-release@v2
        with:
          files: dist/*