.goreleaser.yml

version: 2

project_name: web-researcher-mcp

before:
  hooks:
    - go mod tidy
    - go mod verify

builds:
  - id: web-researcher-mcp
    main: ./cmd/web-researcher-mcp
    binary: web-researcher-mcp
    env:
      - CGO_ENABLED=0
    goos:
      - linux
      - darwin
      - windows
    goarch:
      - amd64
      - arm64
    ignore:
      - goos: windows
        goarch: arm64
    ldflags:
      - -s -w
      - -X main.version={{.Version}}
      - -X main.commit={{.Commit}}
      - -X main.date={{.Date}}
    mod_timestamp: "{{ .CommitTimestamp }}"
    # Authenticode-sign the Windows .exe IN PLACE right after compile, BEFORE the
    # archive/checksum/scoop/winget/cask pipes — so every downstream hash derives
    # from the SIGNED binary in one run (no post-hoc re-zip + checksum rewrite, no
    # Scoop/WinGet hash drift). The wrapper no-ops for non-windows targets and when
    # AZURE_SIGNING_ENABLED != true (snapshot/local/no-creds), mirroring the macOS
    # notarize self-gate. See scripts/sign-windows.sh + docs/RELEASE_SIGNING.md.
    hooks:
      post:
        - cmd: ./scripts/sign-windows.sh "{{ .Path }}" "{{ .Os }}" "{{ .Arch }}"
          output: true

# macOS Developer ID signing + Apple notarization (cross-platform, OSS — runs on
# the Linux release runner via GoReleaser's bundled quill; no macOS runner, no
# Pro license). Clears Gatekeeper's "developer cannot be verified" warning for
# users who download the darwin tarballs via a browser (the quarantine path;
# Homebrew/curl/Docker installs are unaffected either way). Signs the darwin
# binaries BEFORE the archives block tars them. Self-gated on the signing
# secret, so local/snapshot builds and any run without the cert skip cleanly
# (zero regression) — mirrors the AZURE_SIGNING_ENABLED gate for Windows.
# Stapling is intentionally absent: a bare Mach-O can't be stapled, and
# Gatekeeper verifies notarization online on first launch. See docs/RELEASE_SIGNING.md.
notarize:
  macos:
    - enabled: '{{ isEnvSet "MACOS_SIGN_P12" }}'
      ids:
        - web-researcher-mcp
      sign:
        certificate: "{{.Env.MACOS_SIGN_P12}}"
        password: "{{.Env.MACOS_SIGN_PASSWORD}}"
      notarize:
        issuer_id: "{{.Env.MACOS_NOTARY_ISSUER_ID}}"
        key_id: "{{.Env.MACOS_NOTARY_KEY_ID}}"
        key: "{{.Env.MACOS_NOTARY_KEY}}"
        wait: true
        timeout: 20m

archives:
  - id: default
    format: tar.gz
    format_overrides:
      - goos: windows
        format: zip
    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
    files:
      - README.md
      - LICENSE*
      # lens JSON files live flat in lenses/ (no subdirs), so "lenses/**/*"
      # matched nothing and silently excluded them from release archives.
      # "lenses/*" captures the flat files; "lenses/**/*" would only match
      # nested paths.
      - lenses/*
      - server.json
      - smithery.yaml

checksum:
  name_template: "checksums.txt"
  algorithm: sha256

sboms:
  - artifacts: archive

dockers:
  # GHCR images
  - image_templates:
      - "ghcr.io/zoharbabin/web-researcher-mcp:{{ .Version }}-amd64"
      - "ghcr.io/zoharbabin/web-researcher-mcp:latest-amd64"
    use: buildx
    build_flag_templates:
      - "--platform=linux/amd64"
      - "--label=org.opencontainers.image.title={{ .ProjectName }}"
      - "--label=org.opencontainers.image.description=Your AI research assistant that cites real sources and stays honest"
      - "--label=org.opencontainers.image.version={{ .Version }}"
      - "--label=org.opencontainers.image.created={{ .Date }}"
      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
      - "--label=org.opencontainers.image.source=https://github.com/zoharbabin/web-researcher-mcp"
      - "--label=org.opencontainers.image.licenses=MIT"
      - "--label=io.modelcontextprotocol.server.name=io.github.zoharbabin/web-researcher-mcp"
    dockerfile: Dockerfile.release
    extra_files:
      - lenses/
    goarch: amd64
    goos: linux

  - image_templates:
      - "ghcr.io/zoharbabin/web-researcher-mcp:{{ .Version }}-arm64"
      - "ghcr.io/zoharbabin/web-researcher-mcp:latest-arm64"
    use: buildx
    build_flag_templates:
      - "--platform=linux/arm64"
      - "--label=org.opencontainers.image.title={{ .ProjectName }}"
      - "--label=org.opencontainers.image.description=Your AI research assistant that cites real sources and stays honest"
      - "--label=org.opencontainers.image.version={{ .Version }}"
      - "--label=org.opencontainers.image.created={{ .Date }}"
      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
      - "--label=org.opencontainers.image.source=https://github.com/zoharbabin/web-researcher-mcp"
      - "--label=org.opencontainers.image.licenses=MIT"
      - "--label=io.modelcontextprotocol.server.name=io.github.zoharbabin/web-researcher-mcp"
    dockerfile: Dockerfile.release
    extra_files:
      - lenses/
    goarch: arm64
    goos: linux

  # Docker Hub images
  - image_templates:
      - "docker.io/zoharbabin/web-researcher-mcp:{{ .Version }}-amd64"
      - "docker.io/zoharbabin/web-researcher-mcp:latest-amd64"
    use: buildx
    build_flag_templates:
      - "--platform=linux/amd64"
      - "--label=org.opencontainers.image.title={{ .ProjectName }}"
      - "--label=org.opencontainers.image.description=Your AI research assistant that cites real sources and stays honest"
      - "--label=org.opencontainers.image.version={{ .Version }}"
      - "--label=org.opencontainers.image.created={{ .Date }}"
      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
      - "--label=org.opencontainers.image.source=https://github.com/zoharbabin/web-researcher-mcp"
      - "--label=org.opencontainers.image.licenses=MIT"
      - "--label=io.modelcontextprotocol.server.name=io.github.zoharbabin/web-researcher-mcp"
    dockerfile: Dockerfile.release
    extra_files:
      - lenses/
    goarch: amd64
    goos: linux

  - image_templates:
      - "docker.io/zoharbabin/web-researcher-mcp:{{ .Version }}-arm64"
      - "docker.io/zoharbabin/web-researcher-mcp:latest-arm64"
    use: buildx
    build_flag_templates:
      - "--platform=linux/arm64"
      - "--label=org.opencontainers.image.title={{ .ProjectName }}"
      - "--label=org.opencontainers.image.description=Your AI research assistant that cites real sources and stays honest"
      - "--label=org.opencontainers.image.version={{ .Version }}"
      - "--label=org.opencontainers.image.created={{ .Date }}"
      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
      - "--label=org.opencontainers.image.source=https://github.com/zoharbabin/web-researcher-mcp"
      - "--label=org.opencontainers.image.licenses=MIT"
      - "--label=io.modelcontextprotocol.server.name=io.github.zoharbabin/web-researcher-mcp"
    dockerfile: Dockerfile.release
    extra_files:
      - lenses/
    goarch: arm64
    goos: linux

docker_manifests:
  # GHCR manifests
  - name_template: "ghcr.io/zoharbabin/web-researcher-mcp:{{ .Version }}"
    image_templates:
      - "ghcr.io/zoharbabin/web-researcher-mcp:{{ .Version }}-amd64"
      - "ghcr.io/zoharbabin/web-researcher-mcp:{{ .Version }}-arm64"
  - name_template: "ghcr.io/zoharbabin/web-researcher-mcp:latest"
    image_templates:
      - "ghcr.io/zoharbabin/web-researcher-mcp:latest-amd64"
      - "ghcr.io/zoharbabin/web-researcher-mcp:latest-arm64"
  # Docker Hub manifests
  - name_template: "docker.io/zoharbabin/web-researcher-mcp:{{ .Version }}"
    image_templates:
      - "docker.io/zoharbabin/web-researcher-mcp:{{ .Version }}-amd64"
      - "docker.io/zoharbabin/web-researcher-mcp:{{ .Version }}-arm64"
  - name_template: "docker.io/zoharbabin/web-researcher-mcp:latest"
    image_templates:
      - "docker.io/zoharbabin/web-researcher-mcp:latest-amd64"
      - "docker.io/zoharbabin/web-researcher-mcp:latest-arm64"

brews:
  - name: web-researcher-mcp
    repository:
      owner: zoharbabin
      name: homebrew-tap
      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
    directory: Formula
    homepage: "https://github.com/zoharbabin/web-researcher-mcp"
    description: "Your AI research assistant that cites real sources and stays honest"
    license: "MIT"
    skip_upload: auto
    test: |
      system "#{bin}/web-researcher-mcp", "--help"
    install: |
      bin.install "web-researcher-mcp"
      (share/"web-researcher-mcp/lenses").install Dir["lenses/*"] if Dir.exist?("lenses")

# ── Homebrew Cask (macOS, notarized binary) ──────────────────────────────────
# Optional, opt-in macOS distribution alongside the formula above. The cask
# ships the DEVELOPER-ID-SIGNED + NOTARIZED darwin binary, so a `brew install
# --cask` user gets a Gatekeeper-clean artifact. It lives in the SAME tap as the
# formula: `brew install zoharbabin/tap/web-researcher-mcp` resolves to the
# formula (precedence); `brew install --cask zoharbabin/tap/web-researcher-mcp`
# gets this cask. Gated via skip_upload so it no-ops until the tap token exists
# (it shares HOMEBREW_TAP_GITHUB_TOKEN, already set — `auto` skips prereleases).
homebrew_casks:
  - name: web-researcher-mcp
    repository:
      owner: zoharbabin
      name: homebrew-tap
      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
    directory: Casks
    homepage: "https://github.com/zoharbabin/web-researcher-mcp"
    description: "Your AI research assistant that cites real sources and stays honest"
    skip_upload: auto
    binaries:
      - web-researcher-mcp
    # The binary is notarized; clear the quarantine xattr on install so Gatekeeper
    # doesn't re-prompt for the Homebrew-placed file.
    hooks:
      post:
        install: |
          if OS.mac?
            system_command "/usr/bin/xattr",
                           args: ["-dr", "com.apple.quarantine", "#{staged_path}/web-researcher-mcp"],
                           sudo: false
          end

# ── Scoop (Windows) ──────────────────────────────────────────────────────────
# Publishes a manifest to the zoharbabin/scoop-bucket repo. Gated on
# SCOOP_BUCKET_GITHUB_TOKEN via skip_upload: when the token is absent the
# template yields "true" and GoReleaser builds the manifest but skips the push
# (zero regression). Install: `scoop bucket add zoharbabin https://github.com/
# zoharbabin/scoop-bucket; scoop install web-researcher-mcp`.
scoops:
  - name: web-researcher-mcp
    repository:
      owner: zoharbabin
      name: scoop-bucket
      token: "{{ .Env.SCOOP_BUCKET_GITHUB_TOKEN }}"
      branch: main
    directory: bucket
    homepage: "https://github.com/zoharbabin/web-researcher-mcp"
    description: "Your AI research assistant that cites real sources and stays honest"
    license: "MIT"
    skip_upload: '{{ if isEnvSet "SCOOP_BUCKET_GITHUB_TOKEN" }}auto{{ else }}true{{ end }}'

# ── WinGet (Windows Package Manager) ─────────────────────────────────────────
# Generates the WinGet manifest and commits it to a branch on the
# zoharbabin/winget-pkgs fork. The maintainer then opens the PR to
# microsoft/winget-pkgs manually for Microsoft's review (smooth because our .exe
# is Azure Trusted Signing-signed with a Microsoft-issued cert). Auto-PR is
# intentionally DISABLED: a fine-grained PAT scoped to the fork can push the
# branch but cannot open a PR against microsoft/winget-pkgs (the upstream returns
# "403 Resource not accessible by personal access token"), and Microsoft's first
# submission requires a manual review regardless — so an auto-PR attempt only
# fails the release for a step that must be manual anyway. Gated on
# WINGET_PKGS_GITHUB_TOKEN via skip_upload. Install (once accepted upstream):
# `winget install zoharbabin.web-researcher-mcp`.
winget:
  - name: web-researcher-mcp
    publisher: zoharbabin
    short_description: "Your AI research assistant that cites real sources and stays honest"
    license: "MIT"
    homepage: "https://github.com/zoharbabin/web-researcher-mcp"
    publisher_url: "https://github.com/zoharbabin"
    package_identifier: zoharbabin.web-researcher-mcp
    repository:
      owner: zoharbabin
      name: winget-pkgs
      branch: "web-researcher-mcp-{{ .Version }}"
      token: "{{ .Env.WINGET_PKGS_GITHUB_TOKEN }}"
    skip_upload: '{{ if isEnvSet "WINGET_PKGS_GITHUB_TOKEN" }}false{{ else }}true{{ end }}'

# ── Chocolatey (Windows) ─────────────────────────────────────────────────────
# Builds the .nupkg from the windows amd64 archive. Publishing requires the
# `choco` CLI + the API key; GoReleaser shells out to `choco push`. The release
# workflow installs choco (via mono) and exports CHOCOLATEY_API_KEY only when
# the secret is present; skip_publish stays false so a configured run publishes.
# When CHOCOLATEY_API_KEY is unset the workflow skips the choco setup, GoReleaser
# can't find `choco`, so we keep the build resilient by leaving the nupkg as a
# release artifact regardless. Install: `choco install web-researcher-mcp`.
chocolateys:
  - name: web-researcher-mcp
    title: "Web Researcher MCP"
    authors: "Zohar Babin"
    project_url: "https://github.com/zoharbabin/web-researcher-mcp"
    license_url: "https://github.com/zoharbabin/web-researcher-mcp/blob/main/LICENSE"
    project_source_url: "https://github.com/zoharbabin/web-researcher-mcp"
    docs_url: "https://github.com/zoharbabin/web-researcher-mcp/blob/main/README.md"
    bug_tracker_url: "https://github.com/zoharbabin/web-researcher-mcp/issues"
    icon_url: "https://raw.githubusercontent.com/zoharbabin/web-researcher-mcp/main/assets/logo.png"
    copyright: "2026 Zohar Babin"
    summary: "Your AI research assistant that cites real sources and stays honest"
    description: |
      Web Researcher MCP is an MCP server that gives AI assistants web search,
      content extraction, academic / patent / SEC-filing / case-law / economic
      data lookup, and multi-step research — with real, verifiable citations.
    tags: "mcp ai research search web-scraping cli"
    require_license_acceptance: false
    source_repo: "https://push.chocolatey.org/"
    api_key: "{{ .Env.CHOCOLATEY_API_KEY }}"
    skip_publish: false

changelog:
  sort: asc
  use: github
  groups:
    - title: "New Features"
      regexp: '^.*?feat(\([[:word:]]+\))??!?:.+$'
      order: 0
    - title: "Bug Fixes"
      regexp: '^.*?fix(\([[:word:]]+\))??!?:.+$'
      order: 1
    - title: "Performance"
      regexp: '^.*?perf(\([[:word:]]+\))??!?:.+$'
      order: 2
    - title: "Other"
      order: 999
  filters:
    exclude:
      - "^docs:"
      - "^test:"
      - "^ci:"
      - "^chore:"
      - "^style:"

release:
  github:
    owner: zoharbabin
    name: web-researcher-mcp
  draft: false
  prerelease: auto
  name_template: "{{.ProjectName}} v{{.Version}}"
  header: |
    ## What's Changed

    Full changelog: https://github.com/zoharbabin/web-researcher-mcp/compare/{{ .PreviousTag }}...{{ .Tag }}
  footer: |
    ---

    ### Docker Images

    ```bash
    # GitHub Container Registry
    docker pull ghcr.io/zoharbabin/web-researcher-mcp:{{ .Version }}

    # Docker Hub
    docker pull docker.io/zoharbabin/web-researcher-mcp:{{ .Version }}
    ```

    ### Homebrew

    ```bash
    brew install zoharbabin/tap/web-researcher-mcp
    ```

    ### Verify Checksums

    ```bash
    sha256sum -c checksums.txt
    ```