release.yaml

name: Release

on:
  workflow_dispatch:
  push:
    branches:
      - 'main'
    tags:
      - 'v*'

permissions:
  contents: read

env:
  GO_VERSION: "1.26.4"

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write   # GoReleaser needs write access on tag pushes
      packages: write   # in case images are published to GHCR
      id-token: write   # for OIDC / SBOM signing
    env:
      GO111MODULE: on
      DOCKER_CLI_EXPERIMENTAL: "enabled"
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Set up QEMU
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Install Syft (for SBOM generation)
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0

      - name: Run go vet
        run: go vet ./...

      - name: Tests with coverage
        run: |
          go test -race -count=1 -coverprofile=coverage.out -covermode=atomic ./...
          go tool cover -func=coverage.out | tail -n 1

      - name: Check coverage threshold
        run: |
          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
          echo "Total coverage: ${COVERAGE}%"
          if [ -z "$COVERAGE" ]; then
            echo "Failed to extract coverage percentage"
            exit 1
          fi
          THRESHOLD=80
          if awk -v c="$COVERAGE" -v t="$THRESHOLD" 'BEGIN { exit !(c < t) }'; then
            echo "::warning::Coverage ${COVERAGE}% is below threshold ${THRESHOLD}%"
          else
            echo "Coverage ${COVERAGE}% meets threshold ${THRESHOLD}%"
          fi

      - name: Login to Docker Hub
        if: github.event_name != 'pull_request' && startsWith(github.ref, 'refs/tags/')
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        if: github.event_name != 'pull_request' && startsWith(github.ref, 'refs/tags/')
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        if: success() && startsWith(github.ref, 'refs/tags/')
        with:
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}