release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Validate tag format
        run: |
          if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Tag '$GITHUB_REF_NAME' does not match vX.Y.Z format"
            exit 1
          fi
        env:
          GITHUB_REF_NAME: ${{ github.ref_name }}

      - name: Package agent
        run: |
          mkdir -p dist
          zip -j dist/reframe-agent.zip .github/agents/reframe.agent.md
          cp install.ps1 dist/install.ps1

      - name: Generate checksums
        run: |
          cd dist
          sha256sum reframe-agent.zip install.ps1 > checksums.sha256
          cat checksums.sha256

      - name: Create release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        with:
          tag_name: ${{ github.ref_name }}
          name: ReFrame ${{ github.ref_name }}
          body: |
            See [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/${{ github.ref_name }}/CHANGELOG.md) for full release notes.

            ## Installation

            ```powershell
            irm https://raw.githubusercontent.com/${{ github.repository }}/${{ github.ref_name }}/install.ps1 | iex
            ```

            Or pin to this release tag for a verifiable install:

            ```powershell
            .\install.ps1 -Ref ${{ github.ref_name }}
            ```

            Verify the download against `checksums.sha256` before running — see [SECURITY.md](https://github.com/${{ github.repository }}/blob/${{ github.ref_name }}/SECURITY.md).
          files: |
            dist/reframe-agent.zip
            dist/install.ps1
            dist/checksums.sha256
          fail_on_unmatched_files: true
          draft: false
          prerelease: false