name: release

# 1.2.3 is a release, anything with a suffix (1.2.3-rc.1) a prerelease. The tags
# carry no v prefix.
on:
  push:
    tags: ["[0-9]+.[0-9]+.[0-9]+*"]

permissions:
  contents: write
  packages: write
  id-token: write

jobs:
  image:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # Emulation for the RUN steps of the non-native platforms.
      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      # The tag is v-less already, so {{version}} is the tag itself. major.minor and
      # major are skipped for prereleases by the action itself.
      - id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          sbom: true
          provenance: mode=max

  release:
    runs-on: ubuntu-latest
    needs: image
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Create the GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          flags=()
          case "${GITHUB_REF_NAME}" in
            *-*) flags+=(--prerelease) ;;
            # Notes for a stable release span back to the previous stable tag in its
            # history, not to the last RC or a newer release on another branch.
            *)
              prev=$(git describe --tags --abbrev=0 --match '[0-9]*' --exclude '*-*' "${GITHUB_REF_NAME}^" 2>/dev/null || true)
              [ -n "${prev}" ] && flags+=(--notes-start-tag "${prev}")
              ;;
          esac
          gh release create "${GITHUB_REF_NAME}" --verify-tag --generate-notes "${flags[@]}"