release.yml

name: release

# Fires on tag pushes that look like a semver release. Manual dispatch
# stays available for re-runs without re-tagging.
on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

# A tag-push and a manual dispatch on the same ref shouldn't fight.
# Don't cancel-in-progress for releases — half-completed releases are
# worse than waiting for the queued one.
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write   # create the GitHub release + upload archives
  packages: write   # push images to ghcr.io

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0   # goreleaser needs full history to compute the changelog

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.13

      - name: Set up just
        uses: extractions/setup-just@v4

      # QEMU isn't strictly required for Option B (we cross-compile Go on
      # the host), but docker buildx prefers having it available for the
      # alpine prep stage when building the arm64 image on an amd64
      # runner. Cheap to install; skips quickly if unused.
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run goreleaser
        uses: goreleaser/goreleaser-action@v7
        with:
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Native desktop bundles. All matrix steps live in _tauri-shared.yml.
  tauri:
    needs: goreleaser
    uses: ./.github/workflows/_tauri-shared.yml
    secrets: inherit
    permissions:
      contents: write   # tauri-action uploads bundles to the existing release
    with:
      tagName: ${{ github.ref_name }}

  update-release-docs:
    name: Update release docs
    needs: tauri
    runs-on: ubuntu-latest
    # Only tag-triggered releases publish assets. Manual workflow_dispatch runs
    # may point at a branch, where github.ref_name is not a release tag.
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Checkout master
        uses: actions/checkout@v6
        with:
          ref: master
          fetch-depth: 0

      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.13

      - name: Regenerate release docs
        run: bun scripts/update-release-links.ts "${{ github.ref_name }}"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Commit release docs refresh
        run: |
          if git diff --quiet README.md docs/deployment.md docs/desktop-app.md; then
            echo "Release docs already current"
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add README.md docs/deployment.md docs/desktop-app.md
          git commit -m "docs: update release references [skip ci]" \
            -m "Refresh the Desktop app download table from the actual assets uploaded to the GitHub Release for ${{ github.ref_name }}." \
            -m "Also update pinned Docker and tarball examples so post-release docs match the published tag." \
            -m "Generated by scripts/update-release-links.ts after the Tauri release matrix completes."
          git push origin master