name: CI and releases

on:
  push:
    branches:
      - main
    tags:
      - "v*"
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  quality:
    name: Test and vet
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Test
        shell: bash
        run: |
          set +e
          output="$(go test -count=1 ./... 2>&1)"
          status=$?
          printf '%s\n' "${output}"

          if (( status != 0 )); then
            output="${output//'%'/'%25'}"
            output="${output//$'\r'/'%0D'}"
            output="${output//$'\n'/'%0A'}"
            echo "::error title=Go test failure::${output}"
            exit "${status}"
          fi

      - name: Vet
        run: go vet ./...

  binaries:
    name: Build release binaries
    needs: quality
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum

      - name: Build archives and checksums
        shell: bash
        run: |
          set -euo pipefail

          version="${GITHUB_REF_NAME//\//-}"
          mkdir -p dist staging

          targets=(
            "linux amd64"
            "linux arm64"
            "darwin amd64"
            "darwin arm64"
            "windows amd64"
            "windows arm64"
          )

          for target in "${targets[@]}"; do
            read -r goos goarch <<< "${target}"
            archive="tarakan_${version}_${goos}_${goarch}"
            package="staging/${archive}"
            mkdir -p "${package}"

            binary="tarakan"
            if [[ "${goos}" == "windows" ]]; then
              binary="tarakan.exe"
            fi

            # Strip leading v from tags so main.version matches tarakan --version.
            version_ld="${version#v}"
            CGO_ENABLED=0 GOOS="${goos}" GOARCH="${goarch}" \
              go build -trimpath -ldflags="-s -w -X main.version=${version_ld}" \
              -o "${package}/${binary}" ./cmd/tarakan

            cp LICENSE "${package}/"

            if [[ "${goos}" == "windows" ]]; then
              (cd staging && zip -q -r "../dist/${archive}.zip" "${archive}")
            else
              tar -C staging -czf "dist/${archive}.tar.gz" "${archive}"
            fi
          done

          (cd dist && sha256sum tarakan_* > checksums.txt)

      - name: Upload binaries
        uses: actions/upload-artifact@v7
        with:
          name: tarakan-${{ github.sha }}
          path: dist/
          if-no-files-found: error
          retention-days: 14
          compression-level: 0

  release:
    name: Publish GitHub release
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    needs: binaries
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - name: Download binaries
        uses: actions/download-artifact@v8
        with:
          name: tarakan-${{ github.sha }}
          path: dist/

      - name: Create release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set +e
          output="$(gh release create "${GITHUB_REF_NAME}" dist/* --repo "${GITHUB_REPOSITORY}" --verify-tag --generate-notes 2>&1)"
          status=$?
          printf '%s\n' "${output}"

          if (( status != 0 )); then
            output="${output//'%'/'%25'}"
            output="${output//$'\r'/'%0D'}"
            output="${output//$'\n'/'%0A'}"
            echo "::error title=GitHub release failure::${output}"
            exit "${status}"
          fi