name: Release

# Pushing a version tag builds the release binaries and creates a draft
# GitHub release with them. Review the draft, then publish it.
#   git tag v1.0.0 && git push origin v1.0.0
on:
  push:
    tags: ["v*"]

permissions:
  contents: write # to create the release

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0 # goreleaser needs the tags and history for the changelog
      # Release binaries include the Go standard library, so build them
      # with the newest Go release to get its security fixes.
      - uses: actions/setup-go@v7
        with:
          go-version: stable
          check-latest: true
      - name: govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
      - uses: goreleaser/goreleaser-action@v7
        with:
          version: "~> v2"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}