name: Build and upload binaries
on:
  release:
    types: [published]
  push:
  pull_request:
permissions:
  contents: read
jobs:
  build:
    name: Build binaries
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - {GOOS: linux, GOARCH: amd64}
          - {GOOS: linux, GOARCH: arm, GOARM: 6}
          - {GOOS: linux, GOARCH: arm64}
          - {GOOS: darwin, GOARCH: amd64}
          - {GOOS: darwin, GOARCH: arm64}
          - {GOOS: windows, GOARCH: amd64}
          - {GOOS: freebsd, GOARCH: amd64}
    steps:
      - name: Install Go
        uses: actions/setup-go@v2
        with:
          go-version: 1.x
      - name: Checkout repository
        uses: actions/checkout@v2
        with:
          fetch-depth: 0
      - name: Build binary
        run: |
          cp LICENSE "$RUNNER_TEMP/LICENSE"
          echo -e "\n---\n" >> "$RUNNER_TEMP/LICENSE"
          curl -L "https://go.dev/LICENSE?m=text" >> "$RUNNER_TEMP/LICENSE"
          VERSION="$(git describe --tags)"
          DIR="$(mktemp -d)"
          mkdir "$DIR/age"
          cp "$RUNNER_TEMP/LICENSE" "$DIR/age"
          go build -o "$DIR/age" -ldflags "-X main.Version=$VERSION" -trimpath ./cmd/...
          if [ "$GOOS" == "windows" ]; then
            sudo apt-get update && sudo apt-get install -y osslsigncode
            if [ -n "${{ secrets.SIGN_PASS }}" ]; then
              for exe in "$DIR"/age/*.exe; do
                /usr/bin/osslsigncode sign -t "http://timestamp.comodoca.com" \
                  -certs .github/workflows/certs/uitacllc.crt \
                  -key .github/workflows/certs/uitacllc.key \
                  -pass "${{ secrets.SIGN_PASS }}" \
                  -n age -in "$exe" -out "$exe.signed"
                mv "$exe.signed" "$exe"
              done
            fi
            ( cd "$DIR"; zip age.zip -r age )
            mv "$DIR/age.zip" "age-$VERSION-$GOOS-$GOARCH.zip"
          else
            tar -cvzf "age-$VERSION-$GOOS-$GOARCH.tar.gz" -C "$DIR" age
          fi
        env:
          CGO_ENABLED: 0
          GOOS: ${{ matrix.GOOS }}
          GOARCH: ${{ matrix.GOARCH }}
          GOARM: ${{ matrix.GOARM }}
      - name: Upload workflow artifacts
        uses: actions/upload-artifact@v2
        with:
          name: age-binaries
          path: age-*
  upload:
    name: Upload release binaries
    if: github.event_name == 'release'
    needs: build
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Download workflow artifacts
        uses: actions/download-artifact@v2
        with:
          name: age-binaries
      - name: Upload release artifacts
        run: gh release upload "$GITHUB_REF_NAME" age-*
        env:
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ github.token }}