name: release
on:
  push:
    tags: ["v*"]
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      # actions/checkout v4, 2024-09-16
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          # goreleaser needs the tags and the full history: the version
          # it stamps comes from the tag, and the changelog comes from
          # the commits since the previous one. A shallow checkout
          # silently produces a mislabelled release.
          fetch-depth: 0
      # goreleaser is not a compiler: it shells out to `go` for the
      # `before:` hook and for every one of the four cross-compiles.
      # Nothing else in this repo puts a Go toolchain on the runner --
      # check.yml runs script/cibuild, which does all of its work inside
      # the digest-pinned Dockerfile images -- so without this step the
      # release either fails at the before-hook or, worse, ships binaries
      # built by whatever unpinned Go the runner happens to carry.
      # REPO_POLICIES.md requires every external reference to be pinned,
      # and script/release already refuses a goreleaser that is not the
      # pinned build; the compiler that actually produces the artifacts
      # is the last thing that should be exempt from that.
      #
      # go-version-file rather than a literal: go.mod's `go 1.26.1` is
      # the single source of truth for the toolchain, the same way the
      # Dockerfile FROM line is the single source of truth for the
      # linter version that script/lint enforces. It is a three-component
      # version, so setup-go resolves it exactly -- no silent drift onto
      # a newer patch release.
      #
      # actions/setup-go v5.6.0, 2025-12-15. Pinned by commit sha, like
      # the checkout above. v5.x is a node20 action, matching the node20
      # actions/checkout v4 already in use here; the v6/v7 line requires
      # a node24 runner, which this Gitea runner has never been asked
      # for and cannot be assumed to provide.
      - name: Install Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
        with:
          go-version-file: go.mod
          # setup-go's module cache needs a runner-side cache backend.
          # A release is cut rarely and a cold module download costs
          # seconds; a release failing because a cache service is absent
          # costs a re-tag. Off, deliberately.
          cache: false
      - name: Install goreleaser
        run: script/install-goreleaser
      - name: Release
        run: script/release
        env:
          # RELEASE_TOKEN is a repository Actions secret: a Gitea access
          # token with write access to this repository's releases (scope
          # write:repository), owned by an account that can publish here.
          # It is deliberately not the runner's automatic token, which is
          # not guaranteed to carry that scope.
          GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}