name: Release Automation

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"

concurrency: ci-release-automation

permissions:
  contents: read

jobs:
  goreleaser:
    timeout-minutes: 60
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    permissions:
      contents: write # for goreleaser/goreleaser-action to create a GitHub release
      packages: write # for goreleaser/goreleaser-action to publish docker images
    runs-on: ubuntu-latest
    env:
      # Required for buildx on docker 19.x
      DOCKER_CLI_EXPERIMENTAL: "enabled"
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
        with:
          go-version-file: go.mod

      - name: Run GoReleaser
        id: run-goreleaser
        uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}

      - name: Upload dist Folder
        uses: actions/upload-artifact@7d27270e0cfd253e666c44abac0711308d2d042f # v6.0.0
        with:
          name: dist-artifacts
          path: dist/

  provenance:
    needs: [goreleaser]
    permissions:
      actions: read # To read the workflow path.
      id-token: write # To sign the provenance.
      attestations: write # To write attestations
      artifact-metadata: write # To write artifact metadata
    runs-on: ubuntu-latest
    steps:
      - name: Download dist folder
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: dist-artifacts
          path: dist/

      - name: Attest build provenance (checksums)
        uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0
        with:
          subject-checksums: dist/checksums.txt