release.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: Release

# `just release-publish <version>` pushes a signed tag and drafts the GitHub release on it.
# Publishing that release starts this: the release's images go to GHCR. The same event starts deploy-sites.yml,
# which puts its sites on Cloudflare Workers.
on:
  release:
    types: [published]

permissions: {}

# Queue, never cancel: a release publishes its images exactly once.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
  cancel-in-progress: false

jobs:
  check:
    name: Check version
    runs-on: ubuntu-26.04
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # A release published by hand from a commit `release-prep` never bumped would ship
      # images whose version files name the previous release.
      - name: Tag matches the version files
        env:
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          version="$(jq -r .version package.json)"
          [[ "$TAG_NAME" == "v$version" ]] || {
            echo "release $TAG_NAME is on a commit at version $version; run just release-prep first" >&2
            exit 1
          }

  publish-images:
    name: Publish images
    needs: check
    permissions:
      attestations: write
      contents: write
      id-token: write
      packages: write
    uses: ./.github/workflows/publish-images.yml
    with:
      tag_name: ${{ github.event.release.tag_name }}