Release #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Manually triggered release: validates the clean Go source, tags that exact | |
| # commit, cross-compiles the binaries, and publishes the GitHub release. | |
| # Everything is delegated to scripts/release.sh — the same script a local | |
| # release uses — so the two paths cannot drift apart. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Release version (vX.Y.Z)' | |
| required: true | |
| notes: | |
| description: 'Release notes (markdown); empty uses docs/releases/<version>.md' | |
| required: false | |
| default: '' | |
| dry_run: | |
| description: 'Build and validate everything, publish nothing' | |
| type: boolean | |
| default: false | |
| concurrency: | |
| group: release | |
| cancel-in-progress: false | |
| jobs: | |
| dry-run: | |
| if: ${{ inputs.dry_run }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Check out repository without credentials | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| cache-dependency-path: go.sum | |
| - name: Configure temporary tag identity | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| - name: Verify release locally | |
| env: | |
| VERSION: ${{ inputs.version }} | |
| NOTES: ${{ inputs.notes }} | |
| run: | | |
| set -euo pipefail | |
| notes_file="docs/releases/$VERSION.md" | |
| if [ -n "$NOTES" ]; then | |
| printf '%s' "$NOTES" > "$RUNNER_TEMP/notes.md" | |
| notes_file="$RUNNER_TEMP/notes.md" | |
| fi | |
| bash scripts/release.sh "$VERSION" "$notes_file" --dry-run | |
| release: | |
| if: ${{ !inputs.dry_run }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| cache-dependency-path: go.sum | |
| - name: Configure git identity | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| - name: Cut release | |
| # Inputs reach the shell only through env, never by interpolation | |
| # into the script text. | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| VERSION: ${{ inputs.version }} | |
| NOTES: ${{ inputs.notes }} | |
| run: | | |
| set -euo pipefail | |
| notes_file="docs/releases/$VERSION.md" | |
| if [ -n "$NOTES" ]; then | |
| printf '%s' "$NOTES" > "$RUNNER_TEMP/notes.md" | |
| notes_file="$RUNNER_TEMP/notes.md" | |
| fi | |
| args=("$VERSION" "$notes_file") | |
| bash scripts/release.sh "${args[@]}" |