release-cli.yml

# Publishes the shellcade-kit CLI binary on a vX.Y.Z tag.
#
# The tag is pushed by the changesets publish step (release.yml ->
# scripts/tag-release.sh) and IS the kit module release. This workflow runs
# GoReleaser to build ./cmd/shellcade-kit and attach the cross-platform
# archives + checksums + Homebrew cask to that release, then notifies the
# downstream consumers so they can re-pin to the new toolchain.
name: Release CLI
on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      tag:
        description: "tag to (re)publish, e.g. v2.12.1"
        required: true

permissions:
  contents: read

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          ref: ${{ github.event.inputs.tag || github.ref_name }}
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with: { go-version-file: go.mod }
      - uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        with:
          distribution: goreleaser
          version: "~> v2"
          args: release --clean
        env:
          # Token with contents:write on shellcade/kit (release assets) AND
          # shellcade/homebrew-tap (cask push).
          GITHUB_TOKEN: ${{ secrets.KIT_RELEASE_TOKEN }}
          # macOS signing/notarization — blank until the Apple secrets exist,
          # which leaves notarize disabled (the isEnvSet gate in .goreleaser.yaml).
          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}

  # Tell the consumers a new shellcade-kit binary shipped so they can bump their
  # pinned toolchain. client_payload.version is the released tag (e.g. v2.13.0).
  notify-consumers:
    needs: goreleaser
    runs-on: ubuntu-latest
    strategy:
      matrix:
        repo: [shellcade/shellcade, shellcade/games]
    steps:
      - name: dispatch kit-released to ${{ matrix.repo }}
        env:
          # Cross-repo token: needs contents:write (repository_dispatch) on the
          # target repos. Reuses the same secret the release step uses.
          GH_TOKEN: ${{ secrets.KIT_RELEASE_TOKEN }}
        run: |
          gh api "repos/${{ matrix.repo }}/dispatches" \
            -f event_type=kit-released \
            -F "client_payload[version]=${{ github.event.inputs.tag || github.ref_name }}"