# See https://github.com/containerd/nerdctl/blob/main/MAINTAINERS_GUIDE.md for how to make a release.
name: Release
on:
  push:
    tags:
    - 'v*'
    - 'test-action-release-*'
  pull_request:
    paths-ignore:
    - '**.md'

env:
  GOTOOLCHAIN: local

jobs:
  release:
    runs-on: ubuntu-24.04
    timeout-minutes: 40
    # The maximum access is "read" for PRs from public forked repos
    # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
    permissions:
      contents: write  # for releases
      id-token: write  # for provenances
      attestations: write  # for provenances
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
    # FIXME: setup-qemu-action is depended by `gomodjail pack`
    - name: "Set up QEMU"
      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0
    - name: "Install go"
      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417  # v6.3.0
      with:
        go-version: "1.25"
        check-latest: true
    - name: "Compile binaries"
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: make artifacts
    - name: "SHA256SUMS"
      run: |
        ( cd _output; sha256sum nerdctl-* ) | tee /tmp/SHA256SUMS
        mv /tmp/SHA256SUMS _output/SHA256SUMS
    - name: "The sha256sum of the SHA256SUMS file"
      run: (cd _output; sha256sum SHA256SUMS)
    - name: "Prepare the release note"
      run: |
        shasha=$(sha256sum _output/SHA256SUMS | awk '{print $1}')
        cat <<-EOF | tee /tmp/release-note.txt
        $(hack/generate-release-note.sh)
        - - -
        The binaries were built automatically on GitHub Actions.
        The build log is available for 90 days: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

        The sha256sum of the SHA256SUMS file itself is \`${shasha}\` .
        - - -
        Release manager: [ADD YOUR NAME HERE] (@[ADD YOUR GITHUB ID HERE])
        EOF
    - name: "Generate artifact attestation"
      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
      with:
        subject-path: _output/*
    - name: "Create release"
      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        tag="${GITHUB_REF##*/}"
        gh release create -F /tmp/release-note.txt --draft --title "${tag}" "${tag}" _output/*
