name: release
on:
  push:
    tags: ["v*"]
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      # actions/checkout v4, 2024-09-16
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          # goreleaser needs the tags and the full history: the version
          # it stamps comes from the tag, and the changelog comes from
          # the commits since the previous one. A shallow checkout
          # silently produces a mislabelled release.
          fetch-depth: 0
      - name: Install goreleaser
        run: script/install-goreleaser
      - name: Release
        run: script/release
        env:
          # RELEASE_TOKEN is a repository Actions secret: a Gitea access
          # token with write access to this repository's releases (scope
          # write:repository), owned by an account that can publish here.
          # It is deliberately not the runner's automatic token, which is
          # not guaranteed to carry that scope.
          GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}