name: release

on:
  push:
    tags: ['v*']

# Default to no token permissions; release alone needs release writes.
permissions: {}

jobs:
  release:
    # Releases are published by ermite (git.bnema.dev); the GitHub mirror
    # receives the tags but must not publish a second release or AUR push.
    if: github.server_url != 'https://github.com'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
        with:
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false
      - name: Fetch tags
        run: git fetch --force --tags
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
        with:
          go-version-file: go.mod
      - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a
        with:
          distribution: goreleaser
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # SSH key for the vev-bin AUR push.
          AUR_KEY: ${{ secrets.AUR_KEY }}