cli.yml

# Release workflow for the Go rewrite. Runs on git tags shaped vN.N.N (and
# their pre-release variants), cross-compiles via goreleaser, and uploads
# the artifacts to a GitHub Release consumed by install.sh.
#
# Tagging convention: `v0.3.0`, `v0.3.0-rc.1`. Tag MUST match the version
# in VERSION so `one --version` and the release tag report the same thing.

name: CLI

on:
  push:
    tags:
      - "v*"
  # Manual trigger lets us test goreleaser end-to-end without cutting a tag.
  # Empty tag input -> snapshot mode. Tag input -> full release at that tag.
  workflow_dispatch:
    inputs:
      tag:
        description: "Override tag (snapshot mode if empty)"
        required: false

permissions:
  # goreleaser needs write access to upload release artifacts.
  contents: write

env:
  GOPROXY: https://proxy.golang.org,direct

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Check out
        uses: actions/checkout@v4
        with:
          # goreleaser inspects the full git history for changelog data
          # even though we disabled its auto-changelog — full clone is
          # still cheap and avoids surprise tag-resolution failures.
          fetch-depth: 0

      - name: Check out requested tag
        if: github.event_name == 'workflow_dispatch' && inputs.tag != ''
        run: |
          git fetch --force origin "refs/tags/${{ inputs.tag }}:refs/tags/${{ inputs.tag }}"
          git checkout "tags/${{ inputs.tag }}"

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: packages/cli/go.mod
          cache: true
          cache-dependency-path: packages/cli/go.sum

      - name: Set up pnpm
        uses: pnpm/action-setup@v4
        with:
          run_install: false

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm
          cache-dependency-path: apps/dashboard/pnpm-lock.yaml

      - name: Sync bundled assets
        # packages/cli/internal/bundled/* (registry.json, skills/,
        # _templates/, _web/) is gitignored and regenerated here. Without
        # this step goreleaser would build a binary with empty embeds.
        run: |
          go install github.com/go-task/task/v3/cmd/task@latest
          task sync-bundled
          task sync-web

      # One step decides everything that varies by trigger so the rest of
      # the workflow stays linear:
      #   - tag push (real release)         -> full GitHub Release
      #   - workflow_dispatch with tag      -> full GitHub Release
      #   - workflow_dispatch without tag   -> local snapshot only
      - name: Determine release mode
        id: mode
        run: |
          set -euo pipefail
          if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_type }}" == "tag" ]]; then
            echo "args=release --clean"      >> "$GITHUB_OUTPUT"
          elif [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${{ inputs.tag }}" ]]; then
            echo "args=release --clean"      >> "$GITHUB_OUTPUT"
          else
            echo "args=release --snapshot --clean" >> "$GITHUB_OUTPUT"
          fi

      - name: Run goreleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          version: latest
          args: ${{ steps.mode.outputs.args }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}