.github/workflows/release.yml

# Cuts a GitHub release with prebuilt binaries whenever a v* tag is pushed.
#
# Build provenance attestations are generated for all binaries. Users can verify
# a downloaded binary with:
#   gh attestation verify buildifier-linux-amd64 --repo bazel-contrib/buildtools
name: Release

on:
  push:
    tags:
      - "v*"

# Never let two runs race on the release for the same tag.
concurrency:
  group: release-${{ github.ref_name }}

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      # Create the release and upload its assets.
      contents: write
      # Generate build provenance attestations, see
      # https://github.com/actions/attest#usage
      id-token: write
      attestations: write
      artifact-metadata: write
    env:
      TAG: ${{ github.ref_name }}
    steps:
      - name: Check out ${{ env.TAG }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # status.py stamps the binaries with the output of `git describe --tags`.
          fetch-depth: 0

      - name: Build release binaries
        run: release/build_binaries.sh dist

      - name: Attest build provenance
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/*

      - name: Create or update the release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          if release="$(gh release view "${TAG}" --json isDraft,isImmutable 2> /dev/null)"; then
            is_draft="$(jq -r .isDraft <<< "${release}")"
            if [[ "${is_draft}" == false && "$(jq -r .isImmutable <<< "${release}")" == true ]]; then
              echo "::error::The release for ${TAG} has already been published as immutable," \
                "so its assets can no longer be changed. Cut a new release with a new tag instead."
              exit 1
            fi
            echo "Attaching binaries to the existing release for ${TAG}"
          else
            echo "Creating a draft release for ${TAG}"
            gh release create "${TAG}" --draft --verify-tag --generate-notes \
              --title "Release ${TAG#v} ($(date +%Y-%m-%d))"
            is_draft=true
          fi

          gh release upload "${TAG}" --clobber dist/*

          if [[ "${is_draft}" == true ]]; then
            echo "Publishing the release for ${TAG}"
            gh release edit "${TAG}" --draft=false
          fi