release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. v0.1.0)"
        required: true
        type: string

permissions:
  contents: write
  id-token: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  BIN_NAME: cefas
  NPM_PACKAGE: "@cefasdb/cefas"
  RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ env.RELEASE_TAG }}

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      - name: Test
        run: go test ./cmd/cefasctl/...

      - name: Build binaries
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p dist

          VERSION="${RELEASE_TAG#v}"
          # 386 only makes sense for linux today — it's used by the
          # cefas-sandbox V86 image (V86 is a 32-bit x86 emulator).
          # darwin and windows dropped 386 long ago.
          for GOOS in linux darwin windows; do
            for GOARCH in amd64 arm64 386; do
              if [ "$GOARCH" = "386" ] && [ "$GOOS" != "linux" ]; then
                continue
              fi
              ext=""
              if [ "$GOOS" = "windows" ]; then ext=".exe"; fi
              echo "Building cefasctl $GOOS/$GOARCH"
              CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" \
                go build -trimpath \
                -ldflags "-s -w -X github.com/CefasDb/cefasdb/cmd/cefasctl/cmd.Version=${VERSION}" \
                -o "dist/${BIN_NAME}-${GOOS}-${GOARCH}${ext}" \
                ./cmd/cefasctl
              if [ "$GOOS" = "windows" ]; then
                continue
              fi
              echo "Building cefasdb $GOOS/$GOARCH"
              CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" \
                go build -trimpath \
                -ldflags "-s -w" \
                -o "dist/${BIN_NAME}-server-${GOOS}-${GOARCH}${ext}" \
                ./cmd/cefasdb
            done
          done

      - name: Checksums
        shell: bash
        run: |
          set -euo pipefail
          # dist/ also holds the publishable helm/ and npm/ trees
          # (committed). Only the just-built cefas-* binaries belong
          # in SHA256SUMS.txt.
          (cd dist && shasum -a 256 cefas-* > SHA256SUMS.txt)

      - name: GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          name: ${{ env.RELEASE_TAG }}
          generate_release_notes: true
          files: |
            dist/cefas-*
            dist/SHA256SUMS.txt

      - name: Set up Node
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          registry-url: "https://registry.npmjs.org"
          scope: "@cefasdb"

      - name: Publish npm package (npmjs)
        shell: bash
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "${NODE_AUTH_TOKEN:-}" ]; then
            echo "Missing secret NPM_TOKEN (required to publish to registry.npmjs.org)." >&2
            exit 1
          fi

          VERSION="${RELEASE_TAG#v}"
          cd dist/npm
          npm version --no-git-tag-version --allow-same-version "$VERSION"
          npm pack --dry-run --registry=https://registry.npmjs.org --@cefasdb:registry=https://registry.npmjs.org
          npm publish --access public --registry=https://registry.npmjs.org --@cefasdb:registry=https://registry.npmjs.org

      - name: Smoke test npm install
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          PREFIX="${RUNNER_TEMP}/cefas-npm-smoke"

          for attempt in {1..12}; do
            if npm view "${NPM_PACKAGE}@${VERSION}" version --registry=https://registry.npmjs.org --@cefasdb:registry=https://registry.npmjs.org >/dev/null 2>&1; then
              break
            fi
            if [ "$attempt" -eq 12 ]; then
              echo "Package ${NPM_PACKAGE}@${VERSION} was not visible on npm after waiting." >&2
              exit 1
            fi
            sleep 10
          done

          npm install --global --prefix "$PREFIX" "${NPM_PACKAGE}@${VERSION}" --registry=https://registry.npmjs.org --@cefasdb:registry=https://registry.npmjs.org
          "$PREFIX/bin/${BIN_NAME}" version

  publish-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: ${{ github.repository_owner }}/cefasdb
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ env.RELEASE_TAG }}

      - name: Compute version
        id: vars
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          echo "version=${VERSION}" >>"$GITHUB_OUTPUT"
          echo "image_lower=${REGISTRY}/${IMAGE_NAME,,}" >>"$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push cefas image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./deploy/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          provenance: false
          build-args: |
            VERSION=${{ steps.vars.outputs.version }}
            COMMIT=${{ github.sha }}
          tags: |
            ${{ steps.vars.outputs.image_lower }}:${{ steps.vars.outputs.version }}
            ${{ steps.vars.outputs.image_lower }}:${{ env.RELEASE_TAG }}
            ${{ steps.vars.outputs.image_lower }}:latest
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ steps.vars.outputs.version }}

      # Package visibility is a one-time setting per package, not per release.
      # After the first push, set it via:
      #   https://github.com/users/<owner>/packages/container/cefasdb/settings
      # -> "Danger Zone" -> "Change package visibility" -> Public.
      # The setting persists across all subsequent pushes.