release.yaml

name: Release

on:
  # Release from main branch will be triggered by Buildkite,
  # passing a signing key and allowing a release-ready
  # build to be created.
  repository_dispatch:
    types: release-build

jobs:
  tag:
    runs-on: ubuntu-latest

    outputs:
      version_tag: ${{ steps.tag-release.outputs.version_tag }}

    steps:
      - name: Protect parameters
        uses: cultureamp/protect-event-parameters@v2
        with:
          allowlist: "originating_url,release_version,release_type"

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: "18.x"

      - name: Tag release
        id: tag-release
        run: |
          bin/ci_tag_version "${{ github.event.client_payload.release_version }}" "${{ github.event.client_payload.release_type }}"
        env:
          GITHUB_TOKEN: ${{ github.event.client_payload.github_write_token }}

  publish:
    needs: tag
    runs-on: ubuntu-latest

    steps:
      - name: Protect parameters
        uses: cultureamp/protect-event-parameters@v2
        with:
          allowlist: "originating_url,release_version,release_type"

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Release cfparams
        uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean --verbose
        env:
          GITHUB_TOKEN: ${{ github.event.client_payload.github_write_token }}