releaser.yml

name: GoReleaser

on:
  push:
    tags:
      - 'v*'

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          # go.mod pins a `toolchain` newer than the `go` line, so setup-go
          # installs the older Go and GOTOOLCHAIN downloads the toolchain
          # module into the cache. setup-go's cache tar then collides on those
          # read-only toolchain files, failing every release.
          cache: false
      - name: Setup
        run: |
          curl -LsSf https://astral.sh/uv/install.sh | sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - name: Test
        run: go test -v ./...

  release:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      # ARCHITECTURE: the shared core release workflow runs goreleaser-action
      # on a bare runner, which has no macOS or cross-linux compilers. The
      # binary links Core's tree-sitter grammars (CGO), so releasing it needs
      # the toolchain this maintained image supplies — see .goreleaser.yaml.
      #
      # STOPGAP — the image tag must carry go.mod's Go, and it does not:
      # go.mod says go 1.27.2 and goreleaser-cross publishes no 1.27.2 image
      # (newest is v1.27.1-3, checked 2026-10-13). The image sets no
      # GOTOOLCHAIN, so its go1.27.1 switches to go1.27.2 by downloading the
      # toolchain module from the Go proxy at release time. Re-pin to the
      # first goreleaser-cross tag whose Go equals go.mod's `go` line.
      - name: Install Syft for archive SBOMs
        id: syft
        uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
        with:
          syft-version: v1.44.0
      - name: Run CGO-capable GoReleaser
        run: >-
          docker run --rm
          -e GITHUB_TOKEN
          -v "$GITHUB_WORKSPACE:/workspace"
          -v "$SYFT_PATH:/usr/local/bin/syft:ro"
          -w /workspace
          ghcr.io/goreleaser/goreleaser-cross:v1.27.1-1
          release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
          SYFT_PATH: ${{ steps.syft.outputs.cmd }}