name: release

# Build and publish a release whenever a semver tag is pushed.
on:
  push:
    tags:
      - "v*"

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # GoReleaser needs the full history and tags for the changelog.
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26.x"
          check-latest: false
          cache: false

      - name: Debug secrets
        env:
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITEA_SECRET: ${{ secrets.PACKAGE_TOKEN }}
        run: |
          if [ -z "$GITEA_TOKEN" ]; then
            echo "GITEA_TOKEN is EMPTY"
          else
            echo "GITEA_TOKEN is set (length ${#GITEA_TOKEN})"
          fi
          if [ -z "$GITEA_SECRET" ]; then
            echo "GITEA_SECRET (PACKAGE_TOKEN) is EMPTY"
          else
            echo "GITEA_SECRET (PACKAGE_TOKEN) is set (length ${#GITEA_SECRET})"
          fi

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          version: "~> v2"
          args: release --clean
        env:
          # Gitea injects a repo-scoped token automatically; GoReleaser reads
          # GITEA_TOKEN to publish the release to this instance.
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # The uploads block authenticates to the generic package registry via
          # basic auth (username from config + this token as the password).
          # GoReleaser derives the env name from the upload name: gitea -> GITEA_SECRET.
          GITEA_SECRET: ${{ secrets.PACKAGE_TOKEN}}