cli-release.yml

name: CLI – Release

# Trigger: push a tag of the form cli/vX.Y.Z
# Examples:
#   git tag cli/v1.0.0 && git push origin cli/v1.0.0
on:
    push:
        tags:
            # Require a numeric version immediately after the prefix so that
            # accidental tags like cli/vtest or cli/vfoo never trigger a release.
            - "cli/v[0-9]*"

# Guard: only proceed when the tag is reachable from master/main.
# This prevents a cli/v* tag pushed on a feature branch from publishing a release.
# The check runs as the very first step in each job via job-level `if`.
# github.event.base_ref is the branch the tag points to when pushed via
# `git push origin <tag>`; for annotated tags it may be empty, so we also
# perform an explicit ancestry check inside the changelog job.

# Least-privilege: default to read-only; the release job escalates below.
permissions:
    contents: read

jobs:
    # -------------------------------------------------------------------------
    # 1. Generate the CLI-only changelog
    # -------------------------------------------------------------------------
    changelog:
        name: Generate Changelog
        runs-on: ubuntu-latest
        outputs:
            prev_tag: ${{ steps.prev_tag.outputs.tag }}

        steps:
            - name: Checkout
              uses: actions/checkout@v4
              with:
                  fetch-depth: 0

            - name: Verify tag is on master/main
              shell: bash
              run: |
                  # Abort if the tagged commit is not an ancestor of master (or main).
                  # This prevents a cli/v* tag pushed on a feature branch from
                  # accidentally publishing a release.
                  TAG_SHA=$(git rev-list -n1 "${GITHUB_REF_NAME}")
                  for branch in master main; do
                    if git show-ref --verify --quiet "refs/remotes/origin/${branch}"; then
                      if git merge-base --is-ancestor "${TAG_SHA}" "origin/${branch}"; then
                        echo "Tag ${GITHUB_REF_NAME} (${TAG_SHA}) is on ${branch}. Proceeding."
                        exit 0
                      fi
                    fi
                  done
                  echo "ERROR: Tag ${GITHUB_REF_NAME} is not reachable from master/main. Aborting release." >&2
                  exit 1

            - name: Resolve previous CLI tag
              id: prev_tag
              shell: bash
              run: |
                  CURRENT_TAG="${GITHUB_REF_NAME}"   # e.g. cli/v1.2.0

                  # List cli/v[0-9]* tags reachable from HEAD, sorted ascending by
                  # git's own version comparator (version:refname).  This correctly
                  # orders pre-releases: cli/v1.0.0-rc1 < cli/v1.0.0, unlike sort -V
                  # which can produce the wrong result for pre-release suffixes.
                  # Exclude the current tag then take the last entry = immediate predecessor.
                  PREV=$(git tag --merged HEAD --list 'cli/v[0-9]*' --sort=version:refname \
                           | grep -v "^${CURRENT_TAG}$" \
                           | tail -1)

                  if [[ -z "$PREV" ]]; then
                    echo "No previous CLI tag found – treating this as the first release."
                    PREV="FIRST"
                  fi

                  echo "Previous tag: ${PREV}"
                  echo "tag=${PREV}" >> "$GITHUB_OUTPUT"

            - name: Generate changelog
              id: gen
              shell: bash
              run: |
                  NOTES_FILE="${RUNNER_TEMP}/cli-changelog.md"
                  PREV_TAG="${{ steps.prev_tag.outputs.tag }}"
                  CURRENT_TAG="${GITHUB_REF_NAME}"

                  bash cli/scripts/generate-changelog.sh "${PREV_TAG}" "${CURRENT_TAG}" \
                    > "${NOTES_FILE}"

                  echo "--- Generated changelog ---"
                  cat "${NOTES_FILE}"
                  echo "---"
                  echo "notes_file=${NOTES_FILE}" >> "$GITHUB_OUTPUT"

            - name: Upload changelog artifact
              uses: actions/upload-artifact@v4
              with:
                  name: cli-changelog
                  path: ${{ steps.gen.outputs.notes_file }}
                  retention-days: 1

    # -------------------------------------------------------------------------
    # 2. Run tests before cutting a release
    # -------------------------------------------------------------------------
    test:
        name: Test
        runs-on: ubuntu-latest
        defaults:
            run:
                working-directory: cli

        steps:
            - uses: actions/checkout@v4

            - uses: actions/setup-go@v5
              with:
                  go-version-file: cli/go.mod
                  cache: true
                  cache-dependency-path: cli/go.sum

            - name: Install gotestfmt
              uses: gotesttools/gotestfmt-action@v2
              with:
                  token: ${{ secrets.GITHUB_TOKEN }}

            - name: Run tests
              run: |
                  set -euo pipefail
                  go test -race -json -v ./... 2>&1 | tee /tmp/gotest.log | gotestfmt

    # -------------------------------------------------------------------------
    # 3. GoReleaser – build binaries and publish the GitHub Release
    # -------------------------------------------------------------------------
    release:
        name: Release
        runs-on: ubuntu-latest
        needs: [changelog, test]
        permissions:
            contents: write

        steps:
            - name: Checkout
              uses: actions/checkout@v4
              with:
                  fetch-depth: 0

            - uses: actions/setup-go@v5
              with:
                  go-version-file: cli/go.mod
                  cache: true
                  cache-dependency-path: cli/go.sum

            - name: Download changelog artifact
              uses: actions/download-artifact@v4
              with:
                  name: cli-changelog
                  path: ${{ runner.temp }}

            # GoReleaser uses the tag as-is for the version.
            # cli/v1.2.0 → strip the "cli/" prefix so archives are named v1.2.0.
            - name: Extract semver from tag
              id: semver
              run: |
                  TAG="${GITHUB_REF_NAME}"    # cli/v1.2.0
                  VERSION="${TAG#cli/}"       # v1.2.0
                  echo "version=${VERSION}" >> "$GITHUB_OUTPUT"

            - name: Run GoReleaser
              uses: goreleaser/goreleaser-action@v6
              with:
                  distribution: goreleaser
                  version: "~> v2"
                  # Config lives inside cli/ but GoReleaser runs from the repo root
                  # so that git commands resolve correctly.
                  args: >-
                      release
                      --config cli/.goreleaser.yml
                      --release-notes "${{ runner.temp }}/cli-changelog.md"
                      --clean
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  # Tell GoReleaser to treat the stripped semver as the current tag so
                  # it doesn't choke on the "cli/" prefix.
                  GORELEASER_CURRENT_TAG: ${{ steps.semver.outputs.version }}