release.yml

---
name: Build release binaries

on:
  push:
    tags:
      - "v*"

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build-release:
    runs-on: "ubuntu-latest"
    permissions:
      # unfortunately, this is necessary for creating the release. there is a
      # comnunity discussion tracking a request to implement a more granular
      # permission that as of writing, has not seen any activity since 2023 [0].
      #
      # [0]: https://github.com/orgs/community/discussions/68252
      contents: write
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Go
        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
        with:
          go-version: 1.24.2

      - name: Build
        run: make

      - name: Setup minimal git config
        run: |
          git config --global user.email "action@github.com"
          git config --global user.name "GitHub Action"

      - name: Test
        run: make test

      - name: Build binaries
        run: make releases

      - uses: marvinpinto/action-automatic-releases@919008cf3f741b179569b7a6fb4d8860689ab7f0 # v1.2.1
        with:
          repo_token: "${{ secrets.GITHUB_TOKEN }}"
          draft: true
          prerelease: false
          files: dist/*