.goreleaser.yaml

version: 2

project_name: google-readonly

before:
  hooks:
    # a mutating tidy must fail the release, not build from a dirty tree
    - sh -c "go mod tidy && git diff --exit-code go.mod go.sum"
    - go test ./...

# INT-449: darwin builds with CGO so 99designs/keyring's Keychain backend
# (//go:build darwin && cgo) is compiled in; without it credstore fails
# closed on macOS. linux/windows stay CGO-off static (their keyring
# backends are pure Go; cgo there would regress glibc portability).
# Split is by GOOS only — both darwin amd64 and arm64 are still produced.
builds:
  - id: gro-darwin
    main: ./cmd/gro
    binary: gro
    # Standard keyring opt-out tags (cli-common working-with-secrets.md §1.10).
    flags:
      - -tags=keyring_no1password,keyring_nopassage
    env:
      - CGO_ENABLED=1
    goos:
      - darwin
    goarch:
      - amd64
      - arm64
    overrides:
      - goos: darwin
        goarch: amd64
        goamd64: v1
        env:
          - CGO_ENABLED=1
          - "CC=xcrun clang -arch x86_64"
      - goos: darwin
        goarch: arm64
        goarm64: v8.0
        env:
          - CGO_ENABLED=1
          - "CC=xcrun clang -arch arm64"
    ldflags:
      - -s -w
      - -X github.com/open-cli-collective/google-readonly/internal/version.Version={{.Version}}
      - -X github.com/open-cli-collective/google-readonly/internal/version.Commit={{.Commit}}
      - -X github.com/open-cli-collective/google-readonly/internal/version.Date={{.Date}}
    # macOS code-signing — stable DR so Keychain "Always Allow" survives brew upgrade
    # (cli-common distribution.md §2A). Logic + identity live in open-cli-collective/.github
    # (macos-codesign-setup), which exports CODESIGN_DARWIN_SCRIPT (absolute). Unset in
    # local builds → signing skipped.
    hooks:
      post:
        - cmd: bash -c 'f="${CODESIGN_DARWIN_SCRIPT:-}"; if [ -z "$f" ]; then echo "skip codesign (CODESIGN_DARWIN_SCRIPT unset, local build)"; exit 0; fi; [ -x "$f" ] || { echo "CODESIGN_DARWIN_SCRIPT not executable ($f)" >&2; exit 1; }; exec "$f" "$0" "$1"' "{{ .Path }}" "{{ .Os }}"
  - id: gro-unix-win
    main: ./cmd/gro
    binary: gro
    flags:
      - -tags=keyring_no1password,keyring_nopassage
    env:
      - CGO_ENABLED=0
    goos:
      - linux
      - windows
    goarch:
      - amd64
      - arm64
    ldflags:
      - -s -w
      - -X github.com/open-cli-collective/google-readonly/internal/version.Version={{.Version}}
      - -X github.com/open-cli-collective/google-readonly/internal/version.Commit={{.Commit}}
      - -X github.com/open-cli-collective/google-readonly/internal/version.Date={{.Date}}

archives:
  - formats:
      - tar.gz
    format_overrides:
      - goos: windows
        formats:
          - zip
    # Use binary name with v prefix for archive filenames
    name_template: "gro_v{{ .Version }}_{{ .Os }}_{{ .Arch }}"
    files:
      - LICENSE
      - README.md

# Linux packages (.deb and .rpm)
nfpms:
  - id: google-readonly
    # deb/rpm are linux-only: pull the static CGO-off build, never darwin.
    # `ids` (the v2 build-id filter) — `builds` is deprecated and fails
    # `goreleaser check`.
    ids:
      - gro-unix-win
    package_name: google-readonly
    vendor: Open CLI Collective
    homepage: https://github.com/open-cli-collective/google-readonly
    maintainer: Open CLI Collective <https://github.com/open-cli-collective>
    description: Read-only command-line interface for Google services
    license: MIT
    formats:
      - deb
      - rpm
    bindir: /usr/bin
    contents:
      - src: LICENSE
        dst: /usr/share/licenses/google-readonly/LICENSE

# Canonical Homebrew cask with auto-quarantine removal for non-notarized binaries
# (the darwin binary is code-signed per cli-common distribution.md §2A, not notarized).
# skip_upload: true → goreleaser RENDERS the cask into dist/ but does NOT push
# it; the reusable release workflow's homebrew step is the single atomic tap
# writer. No `token:` here — the tap token belongs only to that writer, and
# skip_upload needs none. No url.template: this is a flat-v repo (no tag rename),
# so goreleaser's default download URL already pins the published tag.
homebrew_casks:
  - name: google-readonly
    skip_upload: true
    repository:
      owner: open-cli-collective
      name: homebrew-tap
    homepage: https://github.com/open-cli-collective/google-readonly
    description: "Read-only command-line interface for Google services"
    binaries: [gro]
    hooks:
      post:
        install: |
          system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/gro"]
    caveats: |
      gro has been installed. Run 'gro init' to configure.
      On macOS, your token is stored securely in the system Keychain.

checksum:
  name_template: "checksums.txt"

changelog:
  sort: asc
  use: github
  filters:
    exclude:
      - "^docs:"
      - "^test:"
      - "^ci:"
      - "^chore:"
      - "Merge pull request"
  groups:
    - title: Features
      regexp: '^feat:'
      order: 0
    - title: Bug Fixes
      regexp: '^fix:'
      order: 1
    - title: Other
      order: 999

release:
  # idempotent re-runs: a retried release overwrites the same assets instead of
  # erroring on "asset already exists" (release-preflight hard-requires this).
  replace_existing_artifacts: true