name: Release

on:
  release:
    types:
    - created
  schedule:
  - cron: '0 1 * * 1-5' # 1 AM UTC is 5 PM PST/ 6 PM PDT
  workflow_dispatch:
jobs:

  publish-cli:
    permissions:
      contents: write
    if: github.event_name == 'release'
    runs-on: ubuntu-latest
    container:
      image: golang:1.23.3-bookworm
    steps:
    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0
    - uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
      with:
        path: /go/pkg/mod
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-
    - name: Debug
      run: |
        pwd
        ls -la
    - name: Set safe directory for Git
      run: |
        echo $GITHUB_WORKSPACE
        git config --global --add safe.directory $GITHUB_WORKSPACE
    - name: Build and Publish CLI
      uses: goreleaser/goreleaser-action@v6
      with:
        version: v2.4.8
        args: release --clean
      env:
        GITHUB_TOKEN: ${{ secrets.TAP_PAT }}

  # publish-unstable-cli:
  #   needs: publish-image
  #   permissions:
  #     id-token: write
  #     contents: read
  #   if: github.event_name != 'release'
  #   runs-on: ubuntu-latest
  #   container:
  #     image: golang:1.23.3-bookworm
  #   strategy:
  #     matrix:
  #       os: [linux, darwin, windows]
  #       arch: [amd64, arm64]
  #   steps:
  #   - name: Checkout code
  #     uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
  #   - uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
  #     with:
  #       path: /go/pkg/mod
  #       key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
  #       restore-keys: |
  #         ${{ runner.os }}-go-
  #   - name: Install pnpm
  #     uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
  #     with:
  #       package_json_file: ui/package.json
  #   - name: Install nodejs
  #     uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
  #     with:
  #       node-version: "22.8.0"
  #       cache: "pnpm"
  #       cache-dependency-path: "**/pnpm-lock.yaml"
  #   - name: Build UI
  #     env:
  #       VERSION: ${{ github.ref_name }}
  #     working-directory: ./ui
  #     run: |
  #       pnpm install
  #       NODE_ENV=production pnpm run build
  #       rm -rf ../internal/api/ui
  #       mv build ../internal/api/ui
  #   - name: Build CLI
  #     env:
  #       GOFLAGS: -buildvcs=false
  #       GOOS: ${{ matrix.os }}
  #       GOARCH: ${{ matrix.arch }}
  #       VERSION: ${{ needs.publish-image.outputs.unstable-version }}
  #       GIT_COMMIT: ${{ github.sha }}
  #       GIT_TREE_STATE: clean
  #     run: make build-nightly-cli
  #   - name: Install awscli
  #     run: |
  #       apt update && apt install awscli -y
  #   - name: Configure AWS credentials
  #     uses: aws-actions/configure-aws-credentials@v4
  #     with:
  #       role-to-assume: ${{ secrets.AWS_ROLE }}
  #       aws-region: us-west-2
  #   - name: Push binaries
  #     env:
  #       CF_DISTRIBUTION_ID: ${{ secrets.CF_DISTRIBUTION_ID }}
  #       VERSION: ${{ needs.publish-image.outputs.unstable-version }}
  #     run: |
  #       aws s3 sync "./bin/kargo-cli/${VERSION}/${{ matrix.os }}/${{ matrix.arch }}" "s3://kargo-release/kargo-cli/${VERSION}/${{ matrix.os }}/${{ matrix.arch }}"
  #       printf "${VERSION}" > ./bin/kargo-cli/unstable.txt
  #       aws s3 cp ./bin/kargo-cli/unstable.txt s3://kargo-release/kargo-cli/unstable.txt
  #       aws cloudfront create-invalidation \
  #         --distribution-id="${CF_DISTRIBUTION_ID}" \
  #         --paths "/kargo-cli/unstable.txt" 

  # combine_hashes:
  #   needs: [publish-cli]
  #   if: github.event_name == 'release'
  #   runs-on: ubuntu-latest
  #   outputs:
  #     hashes: ${{ steps.hashes.outputs.hashes }}
  #   env:
  #     HASHES: ${{ toJSON(needs.publish-cli.outputs) }}
  #   steps:
  #   - id: hashes
  #     run: |
  #       echo "$HASHES" | jq -r '.[] | @base64d' | sed "/^$/d" > hashes.txt
  #       echo "hashes=$(cat hashes.txt | base64 -w0)" >> "$GITHUB_OUTPUT"

  # provenance:
  #   needs: [combine_hashes]
  #   if: github.event_name == 'release'
  #   permissions:
  #     actions: read # To read the workflow path.
  #     id-token: write # To sign the provenance.
  #     contents: write # To add assets to a release.
  #   uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
  #   with:
  #     base64-subjects: "${{ needs.combine_hashes.outputs.hashes }}"
  #     upload-assets: true # Optional: Upload to a new release
  #     provenance-name: kargo-cli.intoto.jsonl
