release.yml

name: Release

on:
  push:
    tags:
      - 'V*'

permissions:
  contents: read

jobs:
  build:
    name: Build
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - os: macos-latest
            target: release-amd64
            artifact_name: binaries-amd64
          - os: macos-latest
            target: release-arm64
            artifact_name: binaries-arm64
    steps:
      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v5
        with:
          go-version-file: go.mod

      - name: Build Binaries
        run: |
          make ${{ matrix.target }}
          ls -l bin/

      - name: Package binaries for Homebrew
        run: |
          cd bin
          # Package binaries into tar.gz for Homebrew resource
          if [[ "${{ matrix.target }}" == "release-arm64" ]]; then
            tar -czf binaries-darwin-arm64.tar.gz analyze-darwin-arm64 status-darwin-arm64
            ls -lh binaries-darwin-arm64.tar.gz
          else
            tar -czf binaries-darwin-amd64.tar.gz analyze-darwin-amd64 status-darwin-amd64
            ls -lh binaries-darwin-amd64.tar.gz
          fi

      - name: Upload artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: ${{ matrix.artifact_name }}
          path: bin/*-darwin-*
          retention-days: 1

  release:
    name: Publish Release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
      attestations: write
      id-token: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: bin
          pattern: binaries-*
          merge-multiple: true

      - name: Display structure of downloaded files
        run: ls -R bin/

      - name: Generate release checksums
        run: |
          cd bin
          mapfile -t release_files < <(find . -maxdepth 1 -type f -printf '%P\n' | sort)
          if [[ ${#release_files[@]} -eq 0 ]]; then
            echo "No release assets found"
            exit 1
          fi
          sha256sum "${release_files[@]}" > SHA256SUMS
          cat SHA256SUMS

      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: |
            bin/analyze-darwin-*
            bin/status-darwin-*
            bin/binaries-darwin-*.tar.gz
            bin/SHA256SUMS

      - name: Create Release
        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
        if: startsWith(github.ref, 'refs/tags/')
        with:
          name: ${{ github.ref_name }}
          files: bin/*
          generate_release_notes: false
          draft: false
          prerelease: false

  update-formula:
    runs-on: ubuntu-latest
    needs: release
    steps:
      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4

      - name: Extract version from tag
        id: tag_version
        run: |
          TAG=${GITHUB_REF#refs/tags/}
          VERSION=${TAG#V}
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Releasing version: $VERSION (tag: $TAG)"

      - name: Update Homebrew formula (Personal Tap)
        env:
          PAT_TOKEN: ${{ secrets.PAT_TOKEN }}
          TAG: ${{ steps.tag_version.outputs.tag }}
          VERSION: ${{ steps.tag_version.outputs.version }}
        run: |
          set -euo pipefail

          curl -fsSL -o /tmp/SHA256SUMS "https://github.com/tw93/Mole/releases/download/${TAG}/SHA256SUMS"
          ARM_SHA=$(awk '$2 == "binaries-darwin-arm64.tar.gz" { print $1 }' /tmp/SHA256SUMS)
          AMD_SHA=$(awk '$2 == "binaries-darwin-amd64.tar.gz" { print $1 }' /tmp/SHA256SUMS)
          SOURCE_SHA=$(curl -fsSL "https://github.com/tw93/Mole/archive/refs/tags/${TAG}.tar.gz" | sha256sum | awk '{print $1}')

          if [[ -z "$ARM_SHA" || -z "$AMD_SHA" || -z "$SOURCE_SHA" ]]; then
            echo "Failed to resolve release checksums"
            exit 1
          fi

          git clone "https://x-access-token:${PAT_TOKEN}@github.com/tw93/homebrew-tap.git" /tmp/homebrew-tap
          ./scripts/update_homebrew_tap_formula.sh \
            --formula /tmp/homebrew-tap/Formula/mole.rb \
            --tag "${TAG}" \
            --source-sha "${SOURCE_SHA}" \
            --arm-sha "${ARM_SHA}" \
            --amd-sha "${AMD_SHA}"

          cd /tmp/homebrew-tap
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          if git diff --quiet -- Formula/mole.rb; then
            echo "No Homebrew formula changes to push"
            exit 0
          fi

          git add Formula/mole.rb
          git commit -m "mole ${VERSION}" -m "Automated release via GitHub Actions"
          git push origin HEAD:main

      - name: Update Homebrew formula (Official Core)
        uses: mislav/bump-homebrew-formula-action@ccf2332299a883f6af50a1d2d41e5df7904dd769 # v4.1
        with:
          formula-name: mole
          homebrew-tap: Homebrew/homebrew-core
          tag-name: ${{ steps.tag_version.outputs.tag }}
          commit-message: |
            mole ${{ steps.tag_version.outputs.version }}

            Automated release via GitHub Actions
        env:
          COMMITTER_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
        continue-on-error: true

      - name: Verify formula updates
        if: success()
        run: |
          echo "✓ Homebrew formulae updated successfully"
          echo "  Version: ${{ steps.tag_version.outputs.version }}"
          echo "  Tag: ${{ steps.tag_version.outputs.tag }}"
          echo "  Personal tap: tw93/homebrew-tap"
          echo "  Official core: Homebrew/homebrew-core (PR created)"