release.yaml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  id-token: write   # keyless cosign signing (Fulcio/Rekor) + build provenance
  attestations: write   # actions/attest-build-provenance (SLSA)

jobs:
  goreleaser:
    name: Release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '1.26.5'

      # cosign for keyless artifact signing (the .goreleaser signs: block invokes
      # `cosign sign-blob --bundle` over checksums.txt using this job's OIDC identity).
      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      # Hard-fail the tag if the committed reference (docs-gen/) is stale, so a
      # release can never ship a reference that lags the code.
      - name: Docs reference drift guard
        run: make check-docs

      # Hard-fail the tag if the binary wouldn't report the tag it's built from.
      # The version is injected by an -X ldflag, which the linker accepts
      # silently even when the target symbol doesn't exist — so a renamed
      # variable or module path would publish a binary that calls itself "dev",
      # with no other signal (#121). Also refuses to publish with CHANGELOG.md
      # still saying [Unreleased].
      - name: Release version guard
        run: scripts/check-release-version.sh "${GITHUB_REF_NAME}"

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          distribution: goreleaser
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
          SCOOP_BUCKET_GITHUB_TOKEN: ${{ secrets.SCOOP_BUCKET_GITHUB_TOKEN }}

      # SLSA build provenance for the release archives. Complements the cosign
      # signature: cosign authenticates the publisher, attestation records how/where
      # the artifacts were built. Attests the checksums.txt (covers every artifact
      # by hash) so a single attestation vouches for the whole release.
      - name: Attest build provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: 'dist/checksums.txt'

      # Nudge the umbrella docs repo to vendor this release's generated reference
      # (docs/gen/truffle/). Needs a cross-repo PAT (DOCS_SYNC_TOKEN); skips
      # cleanly when absent — the weekly sync schedule is the backstop.
      - name: Notify docs site of new release
        if: ${{ !cancelled() }}
        env:
          DOCS_SYNC_TOKEN: ${{ secrets.DOCS_SYNC_TOKEN }}
        run: |
          if [ -z "${DOCS_SYNC_TOKEN:-}" ]; then
            echo "DOCS_SYNC_TOKEN not set — skipping docs dispatch (weekly sync will catch up)."
            exit 0
          fi
          curl -fsS -X POST \
            -H "Authorization: Bearer ${DOCS_SYNC_TOKEN}" \
            -H "Accept: application/vnd.github+json" \
            https://api.github.com/repos/spore-host/spore-host/dispatches \
            -d '{"event_type":"cli-docs-updated","client_payload":{"cli":"truffle"}}'
          echo "✅ Dispatched cli-docs-updated (truffle) to the docs repo"