name: release
on:
  push:
    branches:
      - "main"
    tags:
      - "v*"
permissions:
  contents: read
jobs:
  trigger-generate:
    runs-on: ubuntu-latest
    needs: [goreleaser]
    if: ${{ always() }}
    steps:
      - uses: benc-uk/workflow-dispatch@7a027648b88c2413826b6ddd6c76114894dc5ec4 # v1.3.1
        if: startsWith(github.ref, 'refs/tags/v')
        with:
          repo: goreleaser/goreleaser
          ref: main
          token: ${{ secrets.GH_PAT }}
          workflow: generate.yml
  notify-goreleaser-cross:
    runs-on: ubuntu-latest
    needs: [trigger-generate]
    steps:
      - name: get version
        if: startsWith(github.ref, 'refs/tags/v')
        run: echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
      - name: notify goreleaser-cross with new release
        if: startsWith(github.ref, 'refs/tags/v')
        uses: benc-uk/workflow-dispatch@7a027648b88c2413826b6ddd6c76114894dc5ec4 # v1.3.1
        with:
          token: ${{ secrets.GH_PAT }}
          repo: goreleaser/goreleaser-cross
          ref: master
          workflow: goreleaser-bump
          inputs: '{ "tag" : "${{ env.RELEASE_TAG }}" }'
  verify:
    runs-on: ubuntu-latest
    needs: [goreleaser]
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
      - name: get tag
        run: echo "TAG=${GITHUB_REF#refs/tags/}" >> "$GITHUB_ENV"
      - name: download artifacts
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release download "$TAG" \
            --repo goreleaser/goreleaser \
            --pattern 'goreleaser_Linux_x86_64.tar.gz' \
            --pattern 'checksums.txt' \
            --pattern 'checksums.txt.sigstore.json'
      - name: verify checksums
        run: shasum -a 256 --check --ignore-missing checksums.txt
      - name: verify signature
        run: |
          cosign verify-blob \
            --certificate-identity "https://github.com/goreleaser/goreleaser/.github/workflows/release.yml@refs/tags/$TAG" \
            --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
            --bundle checksums.txt.sigstore.json \
            checksums.txt
      - name: verify attestations
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh attestation verify goreleaser_Linux_x86_64.tar.gz \
            --repo goreleaser/goreleaser \
            --signer-repo goreleaser/goreleaser
  goreleaser-check-pkgs:
    runs-on: ubuntu-latest
    env:
      DOCKER_CLI_EXPERIMENTAL: "enabled"
    needs: [goreleaser]
    if: github.ref == 'refs/heads/main'
    strategy:
      matrix:
        format: [deb, rpm, apk]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ./dist/*.deb
            ./dist/*.rpm
            ./dist/*.apk
          key: ${{ github.sha }}
      - run: task goreleaser:test:${{ matrix.format }}
  goreleaser:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      packages: write
      attestations: write
    env:
      DOCKER_CLI_EXPERIMENTAL: "enabled"
    steps:
      - run: df -h
      - name: "node-cleanup"
        # this should increase free space from ~21gb to ~38gb
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
          sudo docker image prune --all --force
          sudo docker builder prune -a
      - run: df -h
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
      - name: setup-snapcraft
        run: sudo snap install snapcraft --classic
      - name: setup-flatpak
        run: |
          sudo apt update -q
          sudo apt install -yq flatpak flatpak-builder
          sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
          sudo flatpak install -y --noninteractive flathub org.freedesktop.Platform/x86_64/24.08 org.freedesktop.Sdk/x86_64/24.08 org.freedesktop.Platform/aarch64/24.08 org.freedesktop.Sdk/aarch64/24.08
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ./dist/*.deb
            ./dist/*.rpm
            ./dist/*.apk
          key: ${{ github.sha }}
      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
      - uses: crazy-max/ghaction-upx@c83f378efc804f828e988debb88ed6116feb2368 # v4.0.0
        with:
          install-only: true
      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
        with:
          github_access_token: ${{ secrets.GITHUB_TOKEN }}
      - name: dockerhub-login
        if: startsWith(github.ref, 'refs/tags/v')
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: ghcr-login
        if: startsWith(github.ref, 'refs/tags/v')
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
      - uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7.2.1
        if: ${{ startsWith(github.ref, 'refs/tags/v') }} # only on tags
        with:
          distribution: goreleaser-pro
          version: "~> 2"
          args: release --clean --timeout 60m -f .goreleaser-pro.yaml
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_PAT: ${{ secrets.GH_PAT }}
          MASTODON_CLIENT_ID: ${{ secrets.MASTODON_CLIENT_ID }}
          MASTODON_CLIENT_SECRET: ${{ secrets.MASTODON_CLIENT_SECRET }}
          MASTODON_ACCESS_TOKEN: ${{ secrets.MASTODON_ACCESS_TOKEN }}
          FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
          DISCORD_WEBHOOK_ID: ${{ secrets.DISCORD_WEBHOOK_ID }}
          DISCORD_WEBHOOK_TOKEN: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}
          AUR_KEY: ${{ secrets.AUR_KEY }}
          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
          OPENCOLLECTIVE_TOKEN: ${{ secrets.OPENCOLLECTIVE_TOKEN }}
          TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
      - name: goreleaser-snapshot
        if: ${{ !startsWith(github.ref, 'refs/tags/v') }} # on main
        run: |
          go build .
          ./goreleaser release --clean --timeout 60m --snapshot
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        if: ${{ always() }}
        with:
          subject-checksums: ./dist/checksums.txt
      - uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        if: ${{ always() && startsWith(github.ref, 'refs/tags/v') }} # snapshots won't push docker images
        with:
          subject-checksums: ./dist/digests.txt
      - run: df -h
        if: ${{ always() }}
