name: release

on:
  push:
    tags: ['v*']

# Default to no token permissions; release alone needs GitHub Release writes.
permissions: {}

jobs:
  release:
    permissions:
      contents: write
    # Pinned by SHA deliberately: this workflow receives the AUR key.
    # Bump the pin manually when bnema/gh-actions changes.
    uses: bnema/gh-actions/.github/workflows/go-release.yml@fcda8139e65ec45af95bc385e318351c86712d48
    with:
      go-version-file: go.mod
      goreleaser-version: '~> v2'
    secrets:
      AUR_KEY: ${{ secrets.AUR_KEY }}