release.yml

name: 🚀 Release

on: { push }

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  goreleaser:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
      packages: write

    steps:
      - name: Generate winget token
        id: winget_token
        uses: tibdex/github-app-token@v2
        with:
          app_id: ${{ secrets.WINGET_APP_ID }}
          private_key: ${{ secrets.WINGET_APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - name: Set up Go
        uses: actions/setup-go@v5
        with: { go-version-file: go.mod }

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with: { platforms: linux/arm64 }

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        if: startsWith(github.ref, 'refs/tags/v')
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - name: Export GPG key
        run: |
          echo ${{ steps.import_gpg.outputs.fingerprint }} > key.fingerprint
          gpg --armor --export ${{ steps.import_gpg.outputs.keyid }} > key.asc

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          version: latest
          args: release --clean --snapshot=${{ !startsWith(github.ref, 'refs/tags/v') }}
        env:
          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
          WINGET_GITHUB_TOKEN: ${{ steps.winget_token.outputs.token }}