release.yml

# Workflow builds cross-platform binaries and publishes a GitHub release only when commits include "stable release".
# Keeping the matrix explicit makes future platform additions easy to reason about.
name: cross-platform-release

on:
  push:

# Grant write access to release assets so publishing succeeds when the workflow
# tags a stable build. GitHub defaults to read-only tokens, which prevents
# creating releases even though the rest of the pipeline succeeds.
permissions:
  contents: write

jobs:
  build:
    # Run the pipeline only when the commit message explicitly signals a stable release.
    if: contains(github.event.head_commit.message, 'stable release')
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.count }}
    strategy:
      matrix:
        goos: [linux, darwin, windows, freebsd, openbsd]
        goarch: [amd64, arm64]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.21'

      - name: Compute incremental version
        id: version
        run: |
          set -euo pipefail
          echo "count=$(git rev-list --count HEAD)" >> "$GITHUB_OUTPUT"

      - name: Build binary
        env:
          VERSION: ${{ steps.version.outputs.count }}
        run: |
          set -euo pipefail
          ext=""
          if [ "${{ matrix.goos }}" = "windows" ]; then ext=".exe"; fi
          mkdir -p dist
          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} go build \
            -ldflags "-X github.com/matveynator/chicha-ip-proxy/pkg/version.Number=${VERSION}" \
            -o "dist/chicha-ip-proxy-${VERSION}-${{ matrix.goos }}-${{ matrix.goarch }}${ext}"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: chicha-ip-proxy-${{ steps.version.outputs.count }}-${{ matrix.goos }}-${{ matrix.goarch }}
          path: dist/chicha-ip-proxy-${{ steps.version.outputs.count }}-${{ matrix.goos }}-${{ matrix.goarch }}*

  release:
    # Publish only when the commit declares a stable release to keep download links predictable.
    if: contains(github.event.head_commit.message, 'stable release')
    runs-on: ubuntu-latest
    needs: build

    env:
      VERSION: ${{ needs.build.outputs.version }}

    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist

      - name: Collect binaries
        run: |
          set -euo pipefail
          mkdir -p upload
          find dist -maxdepth 3 -type f -name "chicha-ip-proxy-*" -print -exec mv {} upload/ \;

      - name: Publish release
        uses: softprops/action-gh-release@v1
        with:
          tag_name: v${{ env.VERSION }}
          name: Version ${{ env.VERSION }}
          make_latest: true
          files: upload/chicha-ip-proxy-*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}