release.yaml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
---
name: "Release"
on: # yamllint disable-line rule:truthy
  push:
    tags:
      - "*"
  workflow_dispatch:
permissions:
  contents: "read"
jobs:
  goreleaser:
    runs-on: "depot-ubuntu-24.04-4"
    permissions:
      contents: "write"
      packages: "write" # publish to GHCR
    steps:
      - uses: "actions/checkout@v6"
        with:
          fetch-depth: 0
      - uses: "authzed/actions/setup-go@main"
      - uses: "nowsprinting/check-version-format-action@976544c127ab571b88419766cc9d3b459f8d7b82" # v5.0.1
        id: "version"
        with:
          prefix: "v"
      - name: "Fail for an invalid version"
        if: "${{ !startsWith(github.ref_name, 'v') || steps.version.outputs.is_valid != 'true' }}"
        run: 'echo "SpiceDB version must start with `v` and be a semver" && exit 1'
        shell: "bash"
      - name: "Install snapcraft"
        run: |
          sudo snap install snapcraft --channel=8.x/stable --classic
          mkdir -p $HOME/.cache/snapcraft/download
          mkdir -p $HOME/.cache/snapcraft/stage-packages
      - uses: "authzed/actions/docker-login@11667c9b2e8b3649ad2af4d788e57d18f8e8eaf1" # main
        with:
          quayio_token: "${{ secrets.QUAYIO_PASSWORD }}"
          github_token: "${{ secrets.GITHUB_TOKEN }}"
          dockerhub_token: "${{ secrets.DOCKERHUB_ACCESS_TOKEN }}"
      - uses: "docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a" # v4.0.0
      - uses: "docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd" # v4.0.0
      - uses: "goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8" # v7.2.1
        with:
          distribution: "goreleaser-pro"
          # NOTE: keep in sync with goreleaser version in other job.
          # github actions don't allow yaml anchors.
          version: "v2.15.2"
          args: "release --clean"
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          HOMEBREW_TAP_GITHUB_TOKEN: "${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}"
          GORELEASER_KEY: "${{ secrets.GORELEASER_KEY }}"
          GEMFURY_PUSH_TOKEN: "${{ secrets.GEMFURY_PUSH_TOKEN }}"
          SNAPCRAFT_STORE_CREDENTIALS: "${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}"
      - name: "Notify Slack of goreleaser status"
        if: "always()"
        uses: "slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c" # v3.0.3
        with:
          webhook: "${{ secrets.SLACK_WEBHOOK_URL }}"
          webhook-type: "incoming-webhook"
          payload: |
            text: "*SpiceDB Release Finished* with status: ${{ job.status }}"
            blocks:
              - type: "section"
                text:
                  type: "mrkdwn"
                  text: |
                    @eng-oss *SpiceDB Release Finished* with status: ${{ job.status }}
                    *Repository:* <${{ github.server_url }}/${{ github.repository }}|${{ github.repository }}>
                    *Commit:* <${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}|${{ github.sha }}>
                    *Job Run:* <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Job Run>
                    *Actor:* ${{ github.actor }}
                    *Ref:* ${{ github.ref }}
                    *Workflow:* ${{ github.workflow }}