name: Cut Release
on:
  workflow_dispatch: {}

permissions:
  contents: write
  actions: write
  packages: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          fetch-tags: true
          fetch-depth: 0

      - name: build essential
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: latest

      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
          go-version: stable

      - uses: bufbuild/buf-action@8f4a1456a0ab6a1eb80ba68e53832e6fcfacc16c # v1.3.0
        with:
          token: ${{ secrets.BUF_TOKEN }}

      - uses: ko-build/setup-ko@d982fec422852203cfb2053a8ec6ad302280d04d # v0.8

      # docker buildx bake builds multi-platform targets (e.g. iamd on
      # linux/amd64,linux/arm64), which the default docker driver cannot do.
      # QEMU provides cross-arch emulation; buildx sets up a docker-container
      # builder that supports multi-platform builds.
      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log into registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ghcr.io
          username: xe
          password: ${{ secrets.GHCR_PUSH }}

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
      - name: release
        env:
          GITHUB_TOKEN: ${{ secrets.GHCR_PUSH }}
        run: |
          npm ci
          npx semantic-release