release.yaml

name: Release CLI

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  id-token: write # Required for npm OIDC trusted publishers

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.ADMIN_APP_ID }}
          private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
          repositories: cli,homebrew-tap

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'

      - name: Ensure latest npm (>= 11.5.1 for OIDC)
        run: npm install -g npm@latest

      - name: Clean templates
        run: make clean-templates

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser-pro
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}