release.yaml

name: Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (leave empty for auto-bump from conventional commits)'
        required: false
        type: string

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.25'
          cache: true

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Run tests
        run: |
          make build
          go test ./... -v
          make vuln

      - name: Determine version
        id: version
        uses: AxeForging/releaseforge@main
        with:
          command: bump

      - name: Set tag
        id: tag
        run: |
          if [ -n "${{ inputs.tag }}" ]; then
            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "tag=${{ steps.version.outputs.next-version }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Generate release notes
        id: notes
        uses: AxeForging/releaseforge@main
        with:
          command: generate
          api-key: ${{ secrets.GEMINI_API_KEY }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          # If GEMINI_API_KEY is unset/invalid the LLM step fails and releaseforge
          # falls back to git commit-log notes, so the release still succeeds.
          use-git-fallback: "true"

      - name: Create and push tag
        run: |
          echo "Releasing ${{ steps.tag.outputs.tag }}"
          git tag ${{ steps.tag.outputs.tag }}
          git push origin ${{ steps.tag.outputs.tag }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: latest
          args: release --clean --release-notes ${{ steps.notes.outputs.release-notes }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}