when:
  - event: tag
    ref: refs/tags/v*

steps:
  - name: deliver
    image: golang:1.26.8-bookworm
    environment:
      RELEASEKIT_GITEA_TOKEN:
        from_secret: releasekit_gitea_token
    commands:
      - |
        set -eu
        test -n "$${CI_COMMIT_TAG}"
        test -n "$${CI_COMMIT_SHA}"
        git check-ref-format "refs/tags/$${CI_COMMIT_TAG}"
        git fetch origin "refs/tags/$${CI_COMMIT_TAG}:refs/tags/$${CI_COMMIT_TAG}"
        tag_commit=$(git rev-parse --verify "refs/tags/$${CI_COMMIT_TAG}^{commit}")
        expected_commit=$(git rev-parse --verify "$${CI_COMMIT_SHA}^{commit}")
        if [ "$${tag_commit}" != "$${expected_commit}" ]; then
          printf 'Tag %s resolves to commit %s; event %s resolves to commit %s\n' \
            "$${CI_COMMIT_TAG}" "$${tag_commit}" "$${CI_COMMIT_SHA}" "$${expected_commit}" >&2
          exit 1
        fi
        git checkout --detach "$${tag_commit}"
        test "$(git rev-parse HEAD | tr '[:upper:]' '[:lower:]')" = "$${expected_commit}"
        test -z "$(git status --porcelain --untracked-files=all)"

        bootstrap_dir=$(mktemp -d "$${CI_WORKSPACE%/*}/.releasekit-source.XXXXXX")
        trap 'rm -rf "$${bootstrap_dir}"' EXIT
        export GOWORK=off
        export GOTOOLCHAIN=local
        go build -mod=readonly -o "$${bootstrap_dir}/releasekit" ./cmd/releasekit
        "$${bootstrap_dir}/releasekit" ci-deliver \
          --repo "$${CI_WORKSPACE}" \
          --prepared \
          --commit "$${expected_commit}" \
          "$${CI_COMMIT_TAG}"