release.yaml

name: Release

# This GitHub action creates a release when a tag that matches the pattern
# "v*" (e.g. v0.1.0) is created.
on:
  push:
    tags:
      - 'v*'

# Releases need permissions to read and write the repository contents.
# GitHub considers creating releases and uploading assets as writing contents.
permissions:
  contents: write

jobs:
  goreleaser:
    if: github.repository == 'render-oss/cli'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          # Allow goreleaser to access older tag information.
          fetch-depth: 0
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
        with:
          go-version-file: 'go.mod'
          cache: true
      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd  # v7.0.0
        id: import_gpg
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.PASSPHRASE }}
      - name: Extract release notes from CHANGELOG.md
        # Fails the release if CHANGELOG.md doesn't have an entry for this
        # version. Empty release notes are never intentional, and silently
        # shipping a release without them was the pain point that prompted
        # this strictness.
        run: |
          set -eo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          HEAD_SHA="$(git rev-parse --short HEAD)"
          echo "Looking up CHANGELOG.md entry for $VERSION at $HEAD_SHA"

          # `tee` mirrors the extracted notes into the action log; `pipefail`
          # ensures the script's exit status propagates through the pipeline.
          if bin/extract-release-notes.sh "$VERSION" CHANGELOG.md | tee release-notes.md; then
            printf '\n---\n**Full Changelog:** [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md)\n' >> release-notes.md
          else
            echo "::error::No CHANGELOG.md entry found for ${VERSION} at ${HEAD_SHA}. Aborting release."
            echo "::group::Top of CHANGELOG.md at ${HEAD_SHA}"
            head -40 CHANGELOG.md
            echo "::endgroup::"
            exit 1
          fi
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89  # v7.2.2
        with:
          args: release --clean --release-notes=release-notes.md
        env:
          # GitHub sets the GITHUB_TOKEN secret automatically.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}