release-tag.yml

# Copyright The Linux Foundation and each contributor to LFX.
# SPDX-License-Identifier: MIT
---
name: Publish Tagged Release

"on":
  push:
    tags:
      - "v*"

permissions: {}

jobs:
  goreleaser:
    name: GoReleaser
    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff  # v5.6.0
        with:
          go-version-file: go.mod
          # Disable caching: this workflow publishes runtime artifacts on
          # tag push, so a poisoned cache from an earlier run could leak
          # into a release build (zizmor cache-poisoning audit).
          cache: false

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a  # v6.4.0
        with:
          # Constrained to v2 (the action's documented default) so a
          # future GoReleaser v3 release doesn't silently break old tags.
          version: "~> v2"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-docs:
    name: Publish CLI docs to gh-pages
    needs: goreleaser
    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Checkout Code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff  # v5.6.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Generate CLI reference docs
        run: go run ./cmd/lfx docs --output ./docs-out

      - name: Checkout gh-pages
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
        with:
          ref: gh-pages
          path: gh-pages
          persist-credentials: true
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish docs
        run: |
          mkdir -p gh-pages/docs
          cp docs-out/cli.md gh-pages/docs/cli.md
          cd gh-pages
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          if git diff --quiet -- docs/cli.md; then
            echo "No changes to docs/cli.md; skipping commit."
            exit 0
          fi
          git add docs/cli.md
          git commit -s -m "docs: publish CLI reference for ${GITHUB_REF_NAME}"
          git push origin gh-pages