name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to build and release (e.g. v0.1.0)"
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: release-${{ inputs.tag || github.ref_name }}
  cancel-in-progress: false

defaults:
  run:
    shell: bash

jobs:
  build:
    name: Build linux/${{ matrix.goarch }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        goarch: [amd64, arm64]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.23"

      - name: Build
        env:
          GOOS: linux
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: 0
        run: |
          tag="${{ inputs.tag || github.ref_name }}"
          version="${tag#v}"
          go build -trimpath -ldflags="-s -w -X main.version=${version}" \
            -o "vintner-linux-${{ matrix.goarch }}" ./cmd/vintner

      - name: Verify it runs
        if: matrix.goarch == 'amd64'
        run: ./vintner-linux-amd64 version

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: vintner-linux-${{ matrix.goarch }}
          path: vintner-linux-${{ matrix.goarch }}
          if-no-files-found: error
          retention-days: 14

  publish:
    name: Publish release
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Download all architectures
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: vintner-linux-*
          merge-multiple: true

      - name: Checksums
        run: sha256sum vintner-linux-* > SHA256SUMS

      - name: Create or update GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          tag="${{ inputs.tag || github.ref_name }}"
          if ! gh release view "$tag" >/dev/null 2>&1; then
            gh release create "$tag" \
              --title "vintner $tag" \
              --notes "Linux amd64/arm64 binaries built by CI from this tag. See README.md for install instructions."
          fi
          gh release upload "$tag" \
            vintner-linux-* \
            SHA256SUMS \
            --clobber