release.yml

name: Release

# Runs on semver tags pushed to production.
# Produces: multi-arch Docker image, static binaries, SBOM, provenance attestation.
on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write     # create GitHub release + upload assets
  packages: write     # push to GHCR
  id-token: write     # SLSA provenance attestation
  attestations: write # attest artifacts

jobs:
  release:
    runs-on: ubuntu-latest
    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: ${{ github.repository_owner }}/aethercode-execution-engine
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0 # goreleaser needs full history for changelogs

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Set up QEMU (multi-arch builds)
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: "~> v2.6"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: dist/aethercode-exec_linux_amd64_v1/aethercode-exec