name: Release Go binaries

# Two paths land here:
#   pull_request — runs the test job (vet + race-detector tests across the
#     whole module) so every PR proves the binary still builds and passes
#     all tests, not just cmd/molecule.
#   push tags v* — runs test + GoReleaser to cut multi-OS binaries (linux/
#     darwin/windows × amd64/arm64), checksums, and a GitHub Release. The
#     release config lives in .goreleaser.yaml.
#
# Why GoReleaser over inline `go build`: checksums, release notes from
# git commits, and one config file that future channels (Homebrew tap,
# scoop bucket, Chocolatey) hook into without adding new workflow steps.
on:
  push:
    tags: ['v*']
  pull_request:
    paths:
      - '**.go'
      - 'go.mod'
      - 'go.sum'
      - '.github/workflows/release.yml'
      - '.goreleaser.yaml'

permissions:
  contents: write

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.25'
          cache: true
      - name: Tidy
        run: go mod tidy && git diff --exit-code go.sum
      # Vet covers the whole module — was previously scoped to three
      # packages, which silently let regressions in internal/backends/
      # or internal/connect/ ship.
      - name: Vet
        run: go vet ./...
      # Race detector required: the connect orchestrator runs
      # heartbeat + poll goroutines concurrently. A race here would
      # corrupt cursor state.
      - name: Test
        run: go test -race -count=1 ./...

  release:
    runs-on: ubuntu-latest
    needs: [test]
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: actions/checkout@v4
        with:
          # GoReleaser needs full history for its commit-based
          # changelog. fetch-depth: 0 pulls everything.
          fetch-depth: 0
      - uses: actions/setup-go@v5
        with:
          go-version: '1.25'
          cache: true
      - name: Validate goreleaser config
        uses: goreleaser/goreleaser-action@v6
        with:
          version: '~> v2'
          args: check
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}