---
name: Build release binaries

on:
  push:
    tags:
      - "v*"

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build-and-release:
    runs-on: "ubuntu-latest"
    permissions:
      # unfortunately, this is necessary for creating the release. there is a
      # comnunity discussion tracking a request to implement a more granular
      # permission that as of writing, has not seen any activity since 2023 [0].
      #
      # [0]: https://github.com/orgs/community/discussions/68252
      contents: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Setup minimal git config
        run: |
          git config --global user.email "bot@git-bug.org"
          git config --global user.name "git-bug"

      - name: Test with go
        run: nix-shell --run "go test -v -bench=. ./..."

      - name: Determine version string
        id: version-string
        run: |
          v=$(git describe --match='v*' --always --dirty --broken)
          echo "value=${v}" >> "$GITHUB_OUTPUT"

      - name: Build release binaries
        env:
          VERSION: ${{ steps.version-string.outputs.value }}
        run: |
          nix-build -A release --argstr version "$VERSION"

          # this is the symlink to the native output artifact, built by the
          # `default` derivation when the host system is linux or macos. because
          # this job runs on 64-bit linux, we manually rename it so that the
          # artifact uploaded to the GitHub Release is appropriately named for
          # end users
          mv ./result/bin/git-bug ./result/bin/git-bug-linux-amd64
          echo '- version built: `${VERSION}`' >> "$GITHUB_STEP_SUMMARY"

      - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
        with:
          files: result/*

