1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

name: Release

# Creates the release page whenever a tag v* is pushed — what
# ./01-release.tag.sh does at its last line.
#
# hello is a library, so the tag alone already publishes the module: nothing is
# built and nothing is uploaded. What this adds is the page a person reads, and
# a suite that has run against the exact commit the tag is on.
#
# Rickub runs this as an ordinary GitHub Actions workflow. Two platform facts
# matter here: the job's GITHUB_TOKEN is the ONLY credential the release API
# (the /gh shim behind $GITHUB_API_URL) accepts — a personal token is refused —
# and it is read-only unless the workflow asks for `contents: write` below.
#
# No workflow_dispatch on purpose: Rickub's dispatch API fires EVERY
# dispatchable workflow of a ref, so a repository should declare at most one.
on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  release:
    name: publish ${{ github.ref_name }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # The whole history and the tags: the release notes below are read
          # from the annotated tag's message.
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: go vet
        run: go vet ./...

      - name: go test
        run: go test ./... -count=1

      - name: Release notes
        id: notes
        # The message ./01-release.tag.sh put on the annotated tag (ABOUT in
        # release.env), then the one line that installs the module. A
        # lightweight tag has no message: the tag name stands in.
        run: |
          set -euo pipefail
          message="$(git for-each-ref "refs/tags/${GITHUB_REF_NAME}" --format='%(contents)' | sed '/^-----BEGIN PGP SIGNATURE-----/,$d')"
          if [ -z "$(printf '%s' "${message}" | tr -d '[:space:]')" ]; then
            message="hello ${GITHUB_REF_NAME}"
          fi
          {
            printf '%s\n\n' "${message}"
            echo '```bash'
            echo "go get $(go list -m)@${GITHUB_REF_NAME}"
            echo '```'
            echo
            echo "- Commit: \`${GITHUB_SHA}\`"
            echo "- Published by the Release workflow, run #${GITHUB_RUN_NUMBER}, with $(go env GOVERSION)"
          } > "${RUNNER_TEMP}/notes.md"
          echo "path=${RUNNER_TEMP}/notes.md" >> "$GITHUB_OUTPUT"

      - name: Publish the release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          body_path: ${{ steps.notes.outputs.path }}
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}