# https://goreleaser.com/ci/actions/
# TODO: replace other build github actions
name: Build on supported platforms

on:
  push:

permissions:
  contents: write

env:
  GOWORK: off
  CGO_ENABLED: "0"

jobs:
  goreleaser:
    # In-cluster ARC pool (lux-build autoscalingrunnerset in lux-k8s, org-scoped to
    # github.com/luxfi, amd64). GitHub-hosted ubuntu-latest is disabled for this org
    # (NO GITHUB BUILDERS) — that is why this job red-X'd while docker.yml (lux-build)
    # published the image. GoReleaser cross-compiles all GOOS/GOARCH from one linux
    # amd64 host with CGO_ENABLED=0, so a single amd64 runner is sufficient.
    runs-on: lux-build
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: ./.github/actions/setup-go-for-project
      # GoReleaser shells out to `go build`, which must fetch private luxfi
      # modules across REPOS (container, crypto, database, proto, ...). The
      # repo-scoped github.token cannot read other private luxfi repos
      # (`could not read Password ... exit 128`); use the cross-org PAT that
      # docker.yml already relies on (org GH_TOKEN, else repo UNIVERSE_PAT).
      - id: pat
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          UNIVERSE_PAT: ${{ secrets.UNIVERSE_PAT }}
        shell: bash
        run: |
          tok="$GH_TOKEN"; src="GH_TOKEN"
          if [ -z "$tok" ]; then tok="$UNIVERSE_PAT"; src="UNIVERSE_PAT"; fi
          if [ -z "$tok" ]; then
            echo "::error::No GH_TOKEN or UNIVERSE_PAT secret set — go build cannot fetch private cross-repo luxfi modules"
            exit 1
          fi
          echo "Using secret: $src (length=${#tok})"
          echo "::add-mask::$tok"
          git config --global url."https://x-access-token:${tok}@github.com/".insteadOf "https://github.com/"
      - name: Run GoReleaser (release)
        if: startsWith(github.ref, 'refs/tags/')
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: v1.13.1
          # TODO: automate github release page announce and artifact uploads
          # https://goreleaser.com/cmd/goreleaser_release/
          args: release --rm-dist --skip-announce --skip-publish
        # to automate release announcement
        # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#about-the-github_token-secret
        # env:
        # GITHUB_TOKEN: ...
      - name: Run GoReleaser (snapshot)
        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser
          version: v1.13.1
          args: release --rm-dist --snapshot --skip-announce --skip-publish
