release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read

jobs:
  check:
    name: Build and test
    runs-on: ubuntu-latest

    steps:
      - name: Check out tagged source
        uses: actions/checkout@v7

      - name: Build and test
        run: ./test_runner.sh

  release:
    name: Package and publish
    needs: check
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Check out tagged source and history
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Validate release tag
        env:
          TAG: ${{ github.ref_name }}
        run: |
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
            echo "Release tags must be vMAJOR.MINOR or vMAJOR.MINOR.PATCH." >&2
            exit 1
          fi

      - name: Verify tag is on master
        env:
          TAG: ${{ github.ref_name }}
        run: |
          git fetch origin master:refs/remotes/origin/master
          tag_commit="$(git rev-list -n 1 "$TAG")"
          git merge-base --is-ancestor "$tag_commit" origin/master

      - name: Package release assets
        env:
          TAG: ${{ github.ref_name }}
        run: ./scripts/package-release.sh "$TAG" release-artifacts

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          assets=(release-artifacts/*)
          if gh release view "$TAG" >/dev/null 2>&1; then
            gh release upload "$TAG" "${assets[@]}" --clobber
          else
            gh release create "$TAG" "${assets[@]}" --generate-notes --verify-tag
          fi