name: Release

# Push a tag such as v0.2.0 to build and publish a release:
#   git tag -a v0.2.0 -m "hammerhead v0.2.0" && git push origin v0.2.0
on:
  push:
    tags: ['v*']

jobs:
  release:
    runs-on: ubuntu-latest
    env:
      GOPRIVATE: git.veillax.com
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # release notes come from the history since the previous tag

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Let Go fetch modules from this server
        run: git config --global url."https://x-access-token:${{ secrets.GITHUB_TOKEN }}@git.veillax.com/".insteadOf "https://git.veillax.com/"

      - name: Test
        run: |
          go vet ./...
          go test ./...

      - name: Build release archives
        run: sh deploy/build.sh "${GITHUB_REF_NAME}"

      # Optional secret RELEASE_TOKEN: an access token that can write releases, for
      # servers where the automatic job token can't.
      - name: Publish the release
        env:
          TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
        run: sh deploy/publish-release.sh "${GITHUB_REF_NAME}"

      # Skipped when the repository variable PUBLISH_DOCKER is "false", or fails alone
      # if this runner has no Docker: the release above is already published by then.
      # Optional secret REGISTRY_TOKEN (and variable REGISTRY_USER): an access token
      # with package write permission, for servers where the job token can't push.
      - name: Build and push the container image
        if: ${{ vars.PUBLISH_DOCKER != 'false' }}
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
        run: |
          host=${GITHUB_SERVER_URL#*://}
          owner=$(echo "$GITHUB_REPOSITORY_OWNER" | tr 'A-Z' 'a-z')
          image="$host/$owner/hammerhead"
          echo "$REGISTRY_TOKEN" | docker login "$host" -u "$REGISTRY_USER" --password-stdin
          # a container-driver builder can build several architectures in one go
          docker buildx create --name release --driver docker-container --use >/dev/null 2>&1 || docker buildx use release
          tags="-t $image:$GITHUB_REF_NAME"
          case "$GITHUB_REF_NAME" in
            *-*) ;;                       # pre-releases (v1.0.0-rc1) don't move :latest
            *) tags="$tags -t $image:latest" ;;
          esac
          docker buildx build --platform linux/amd64 $tags --push .