release.yaml

name: Publish Lula Packages on Tag

permissions:
  contents: read
  packages: read

on:
  push:
    tags:
      - "v*"

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      # Checkout the repo and setup the tooling for this job
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Setup golang
        uses: ./.github/actions/golang

      - name: Build CLI
        run: |
          make build

      # Upload the contents of the build directory for later stages to use
      - name: Upload build artifacts
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: build-artifacts
          path: bin/
          retention-days: 1

  validate:
    runs-on: ubuntu-latest
    needs: build
    steps:
      # Checkout the repo and setup the tooling for this job
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Download build artifacts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: build-artifacts
          path: bin/

      - name: Setup golang
        uses: ./.github/actions/golang

      - name: Make lula executable
        run: |
          chmod +x bin/lula

      # Build the example packages and run the tests
      - name: Run e2e tests
        run: |
          make test

      - name: Save logs
        if: always()
        uses: ./.github/actions/save-logs

  push:
    runs-on: ubuntu-latest
    environment: prod
    needs: validate
    permissions:
      contents: write
    steps:
      # Checkout the repo and setup the tooling for this job
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Setup golang
        uses: ./.github/actions/golang

      - name: Install tools
        uses: ./.github/actions/install-tools

      - name: Download build artifacts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: build-artifacts
          path: bin/

      - name: Get Brew tap repo token
        id: brew-tap-token
        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
        with:
          app-id: ${{ secrets.HOMEBREW_TAP_WORKFLOW_GITHUB_APP_ID }}
          private-key: ${{ secrets.HOMEBREW_TAP_WORKFLOW_GITHUB_APP_SECRET }}
          owner: defenseunicorns
          repositories: homebrew-tap

      # Create the GitHub release notes
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
        with:
          distribution: goreleaser
          version: latest
          args: release --clean --verbose --config .goreleaser.yaml
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN}}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.brew-tap-token.outputs.token }}