release.yml

name: Release
on:
  workflow_dispatch:

permissions:
  contents: write
  packages: write

env:
  GH_USER: "bearer-bot"

jobs:
  tag:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Bump version and push tag
        if: startsWith(github.ref, 'refs/tags') != true
        id: tag_version
        uses: mathieudutour/github-tag-action@v6.1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          tag_prefix: v
          default_bump: patch
    outputs:
      ref: refs/tags/${{ steps.tag_version.outputs.new_tag || github.ref_name }}

  build:
    needs: [tag]
    name: build
    runs-on: macos-13
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ needs.tag.outputs.ref }}
      - run: git fetch --force --tags
      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: 1.21
      - name: Setup Gon
        run: brew install Bearer/tap/gon
      - name: Import Code-Signing Certificates
        uses: Apple-Actions/import-codesign-certs@v2
        with:
          # The certificates in a PKCS12 file encoded as a base64 string
          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
          # The password used to import the PKCS12 file.
          p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
      - uses: goreleaser/goreleaser-action@v5
        name: Run GoReleaser
        with:
          version: latest
          args: release --clean
        env:
          GOOS: darwin
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AC_APPLICATION_IDENTITY: ${{ secrets.AC_APPLICATION_IDENTITY }}
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
          AC_PROVIDER: ${{ secrets.AC_PROVIDER }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.BEARER_GITHUB_TOKEN }}