release.yaml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'

permissions:
  contents: write
  id-token: write
  packages: read

jobs:
  release:
    runs-on: macos-latest

    steps:
      - name: Configure R2 Credentials
        run: |
          aws configure set aws_access_key_id ${{ secrets.R2_OOMOL_STATIC_S3_AK }}
          aws configure set aws_secret_access_key ${{ secrets.R2_OOMOL_STATIC_S3_SK }}
          aws configure set region auto

      - name: Setup Codesign
        run: |
          echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
          security create-keychain -p action build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p action build.keychain
          security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k action build.keychain
        env:
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}

      - name: Checkout
        uses: "actions/checkout@v4"

      - name: Set up Go
        uses: "actions/setup-go@v5"
        with:
          go-version: '1.23.4'

      - name: Build
        run: make build
        env:
          CODESIGN_IDENTITY: ${{ secrets.CODESIGN_IDENTITY }}

      - name: Gen SHA256
        working-directory: ./out/bin
        run: |
          shasum -a 256 ./* > ../sha256.txt

      - name: Gen Release Notes
        run: |
          echo '```' > ./release_notes.md
          cat ./out/sha256.txt >> ./release_notes.md
          echo '```' >> ./release_notes.md

      - name: Get Tag Name
        shell: bash
        run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV

      - name: Upload To R2
        shell: bash
        run: |
          aws s3 cp \
            --endpoint-url ${{ secrets.R2_OOMOL_STATIC_S3_ENDPOINT }} \
            ./out/bin/ \
            s3://oomol-static/ovm-resources/Bauklotze/$RELEASE_VERSION \
            --recursive --exclude "*" --include "ovm*" --checksum-algorithm CRC32 --debug

      - name: Create Release
        id: create_release
        uses: softprops/action-gh-release@v2
        with:
          files: out/bin/*
          generate_release_notes: true
          body_path: ./release_notes.md
          draft: false
          prerelease: false
          fail_on_unmatched_files: true