1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111

name: RC

# Every push to main publishes a release candidate prerelease:
#   tag v<BASE>-rc.<run_number>, where <BASE> comes from the VERSION file.
# Only the newest push matters, so older in-flight RC runs are cancelled.
#
# NOTE: no workflow_dispatch trigger here on purpose — the rickub dispatch API
# fires *every* dispatchable workflow on a ref, so release.yml is the only
# workflow allowed to declare it. See RELEASING.md.
on:
  push:
    branches:
      - main

# Creating a release requires write access; the default token is read-only.
permissions:
  contents: write

concurrency:
  group: rc
  cancel-in-progress: true

jobs:
  rc:
    name: build and publish release candidate
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: go test
        run: go test ./... -count=1

      - name: Compute RC version
        id: version
        run: |
          set -euo pipefail
          if [ ! -f VERSION ]; then
            echo "::error::VERSION file is missing at the repository root"
            exit 1
          fi
          base="$(tr -d ' \t\r\n' < VERSION)"
          if ! printf '%s' "${base}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::VERSION must contain a bare MAJOR.MINOR.PATCH version (got '${base}')"
            exit 1
          fi
          version="${base}-rc.${{ github.run_number }}"
          {
            echo "base=${base}"
            echo "version=${version}"
            echo "tag=v${version}"
          } >> "$GITHUB_OUTPUT"
          echo "RC version: ${version}"

      - name: Build distribution
        run: bash scripts/build-dist.sh "${{ steps.version.outputs.version }}"

      - name: Release notes
        id: notes
        env:
          RC_VERSION: ${{ steps.version.outputs.version }}
          BASE_VERSION: ${{ steps.version.outputs.base }}
        run: |
          set -euo pipefail
          {
            echo "Automated release candidate for the upcoming **v${BASE_VERSION}**."
            echo
            echo "- Commit: \`${GITHUB_SHA}\`"
            echo "- Build: run #${GITHUB_RUN_NUMBER} of \`${GITHUB_WORKFLOW}\`"
            echo "- Version stamp: \`${RC_VERSION}\` (\`rickub version\`)"
            echo
            echo "> This is a prerelease built automatically from \`main\`."
            echo "> It is not a supported release — use it for testing only."
            echo
            echo '## Checksums'
            echo
            echo '```'
            cat dist/SHA256SUMS
            echo '```'
          } > "${RUNNER_TEMP}/rc-notes.md"
          echo "path=${RUNNER_TEMP}/rc-notes.md" >> "$GITHUB_OUTPUT"

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: rickub-${{ steps.version.outputs.version }}
          path: dist/
          if-no-files-found: error
          retention-days: 14

      - name: Publish prerelease
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          name: ${{ steps.version.outputs.tag }}
          body_path: ${{ steps.notes.outputs.path }}
          # The tag does not exist yet: the rickub release shim creates it at
          # target_commitish, so CI cuts its own RC tags.
          target_commitish: ${{ github.sha }}
          draft: false
          prerelease: true
          files: |
            dist/*.tar.gz
            dist/SHA256SUMS
          fail_on_unmatched_files: true