name: Release

# Releases are driven by release-please but triggered MANUALLY — nothing happens
# on ordinary merges to main. Run this workflow from the Actions tab ("Run
# workflow") when you want to act on releases. Each run does ONE of two things,
# depending on repo state:
#
#   1. If there are releasable commits since the last release and no release PR is
#      merged yet → release-please opens/updates the release PR (version bump in
#      the manifest + pkg/version/version.go, plus generated notes). Review it.
#   2. After you merge that release PR → run this workflow AGAIN; release-please
#      detects the merged release PR, creates the git tag and GitHub Release, and
#      the gated GoReleaser job below builds, signs, and publishes the artifacts.
#
# So a full release is: dispatch → merge the release PR → dispatch again.
#
# Note: release-please creates the tag with GITHUB_TOKEN, which would not trigger
# `on: push: tags` workflows anyway — that is why GoReleaser runs as a gated job
# in this same workflow rather than in a separate tag-triggered one.

on:
  workflow_dispatch:

permissions: {}

jobs:
  release-please:
    name: Release Please
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - name: Run release-please
        id: release
        uses: googleapis/release-please-action@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

  goreleaser:
    name: GoReleaser
    needs: release-please
    if: ${{ needs.release-please.outputs.release_created == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write # Required for cosign keyless signing
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.release-please.outputs.tag_name }}
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.26.4'

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Install syft
        uses: anchore/sbom-action/download-syft@v0

      - name: Generate Homebrew tap token
        id: app-token
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        with:
          app-id: ${{ secrets.HOMEBREW_TAP_APP_ID }}
          private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}
          owner: dynatrace-oss
          repositories: homebrew-tap

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
        with:
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
