name: "Publish tags to FlakeHub"
on:
  push:
    tags:
      - "v?[0-9]+.[0-9]+.[0-9]+*"
  workflow_dispatch:
    inputs:
      tag:
        description: "The existing tag to publish to FlakeHub"
        type: "string"
        required: true
jobs:
  flakehub-publish:
    runs-on: "ubuntu-latest"
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
          ref: "${{ (inputs.tag != null) && format('refs/tags/{0}', inputs.tag) || '' }}"
      - uses: DeterminateSystems/nix-installer-action@e50d5f73bfe71c2dd0aa4218de8f4afa59f8f81d # v16
      - uses: DeterminateSystems/flakehub-push@8da9e38b7e77f2b0a8aa08a22e57cc5c6316ea72 # v5
        with:
          visibility: "public"
          name: "blue-build/cli"
          tag: "${{ inputs.tag }}"
