release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'

permissions:
  contents: read

jobs:
  validate-tag:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Check tag format
        run: |
          tag="${GITHUB_REF_NAME}"
          if ! [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Tag '$tag' does not match required format vX.Y.Z"
            exit 1
          fi

      - name: Check tag is reachable from main
        run: |
          git fetch origin main
          if ! git merge-base --is-ancestor "${GITHUB_SHA}" origin/main; then
            echo "Tag ${GITHUB_REF_NAME} (${GITHUB_SHA}) is not on main, it will not survive the next unrelated deploy/merge."
            exit 1
          fi

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: mbstring, dom, xml
          coverage: none

      - name: Validate composer.json
        run: composer validate --strict

      - name: Install dependencies
        run: composer install --no-interaction --prefer-dist

      - name: Pint (style check)
        run: ./vendor/bin/pint --test

      - name: Larastan (static analysis)
        run: ./vendor/bin/phpstan analyse --no-progress --memory-limit=512M

      - name: Tests
        run: ./vendor/bin/phpunit

      - name: Composer audit
        run: composer audit