name: Continuous Delivery (CD)

on:
  release:
    types: [published]

# https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
permissions:
  contents: write
  packages: write

jobs:
  publish-binary:
    name: Publish Binary
    runs-on: ${{ matrix.architecture }}
    strategy:
      matrix:
        architecture: [ubuntu-24.04, ubuntu-24.04-arm]
    steps:
      - name: Checkout code.
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - name: Setup Nix.
        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
      - name: Publish binary.
        run: nix develop -c make publish-binary RELEASE="${GITHUB_REF_NAME}"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by GitHub Actions.

  publish-crate:
    name: Publish Crate
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout code.
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - name: Setup Nix.
        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
      - name: Publish crate.
        run: nix develop -c make publish-crate
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

  publish-docker:
    name: Publish Docker Image
    runs-on: ubuntu-24.04
    needs: [publish-binary]
    steps:
      - name: Checkout code.
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Login to GitHub Container Registry
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Publish Docker Image
        run: make publish-docker RELEASE="${GITHUB_REF_NAME}"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
