release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  # A manual run packages package.json's version from any branch and keeps the files as run artifacts: it neither waits
  # for Check nor publishes.
  workflow_dispatch:

permissions: {}

env:
  NFPM_VERSION: 2.47.0
  NFPM_SHA256: 0660ca602b2d2d2ae4781a06c692b3eeb9d437ffea05b831d76e41f4a3188783
  ALPINE_IMAGE: alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
  # The OpenWrt packages are PKGARCH all, so any target's SDK builds them.
  OPENWRT_SDK_IMAGE: openwrt/sdk:x86-64-25.12.5@sha256:e916b7cc555890bdc4725c926e139b888294f0c8f56561b88d8da3a6348616a2

jobs:
  # A tag points at a commit that main's Check already ran the browser suite on, so the release waits for that run
  # instead of repeating the suite serially.
  verified:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 40
    permissions:
      actions: read
    env:
      GH_TOKEN: ${{ github.token }}
      GH_REPO: ${{ github.repository }}
    steps:
      - name: Require a successful Check run for this commit
        run: |
          runs="repos/${GITHUB_REPOSITORY}/actions/workflows/check.yml/runs?head_sha=${GITHUB_SHA}&event=push&per_page=1"
          id=$(gh api "$runs" --jq '.workflow_runs[0].id // empty')
          [ -n "$id" ] || { echo "::error::Check has no push run for ${GITHUB_SHA}; tag a commit that is on main." >&2; exit 1; }
          if [ "$(gh run view "$id" --json status --jq .status)" != completed ]; then
            gh run watch "$id" --interval 30 > /dev/null
          fi
          conclusion=$(gh run view "$id" --json conclusion --jq .conclusion)
          [ "$conclusion" = success ] || { echo "::error::Check run $id for ${GITHUB_SHA} ended as '$conclusion'." >&2; exit 1; }

  build:
    needs: [verified]
    if: ${{ !cancelled() && (needs.verified.result == 'success' || github.event_name == 'workflow_dispatch') }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      VERSION: ${{ steps.version.outputs.VERSION }}
      PRERELEASE: ${{ steps.version.outputs.PRERELEASE }}
      ARCH_PRERELEASE: ${{ steps.version.outputs.ARCH_PRERELEASE }}
      NPM: ${{ steps.version.outputs.NPM }}
      PACKAGE_RELEASE: ${{ steps.version.outputs.PACKAGE_RELEASE }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: pnpm
      # The tag names the version; package.json has to agree before anything is built.
      - name: Check the tag against package.json
        id: version
        run: |
          tag=${GITHUB_REF_NAME}
          [ "$GITHUB_EVENT_NAME" = push ] || tag=v$(node -p 'require("./package.json").version')
          eval "$(tools/version.sh "$tag")"
          declared=$(node -p 'require("./package.json").version')
          [ "$NPM" = "$declared" ] || { echo "tag $tag is version $NPM, package.json says $declared" >&2; exit 1; }
          {
            echo "VERSION=$VERSION"
            echo "PRERELEASE=$PRERELEASE"
            echo "ARCH_PRERELEASE=$ARCH_PRERELEASE"
            echo "NPM=$NPM"
            echo "PACKAGE_RELEASE=$PACKAGE_RELEASE"
          } | tee -a "$GITHUB_ENV" >> "$GITHUB_OUTPUT"
      - run: pnpm install --frozen-lockfile
      - run: pnpm check
      - run: pnpm build
      - run: pnpm check:size
      - name: Install asset compressors
        run: sudo apt-get update && sudo apt-get install -y brotli gzip
      - name: Package the archives
        run: |
          if [ "$GITHUB_EVENT_NAME" = push ]; then tools/package.sh --git-version; else tools/package.sh; fi
      # The sums job copies every intermediate artifact into release-assets, so they keep one day; release-assets
      # and the recipes keep the repository's default retention.
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: archives
          path: |
            release/
            !release/SHA256SUMS
          if-no-files-found: error
          retention-days: 1

  # nfpm builds the deb, rpm, ipk and Arch packages in seconds, so one job runs the four formats in turn.
  nfpm:
    needs: [build]
    if: ${{ !cancelled() && needs.build.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      VERSION: ${{ needs.build.outputs.VERSION }}
      PRERELEASE: ${{ needs.build.outputs.PRERELEASE }}
      ARCH_PRERELEASE: ${{ needs.build.outputs.ARCH_PRERELEASE }}
      NPM: ${{ needs.build.outputs.NPM }}
      PACKAGE_RELEASE: ${{ needs.build.outputs.PACKAGE_RELEASE }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: archives
          path: release/
      - name: Install nfpm
        run: |
          curl -fsSL --retry 3 -o "$RUNNER_TEMP/nfpm.tar.gz" \
            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_Linux_x86_64.tar.gz"
          echo "${NFPM_SHA256}  $RUNNER_TEMP/nfpm.tar.gz" | sha256sum -c -
          tar -xzf "$RUNNER_TEMP/nfpm.tar.gz" -C "$RUNNER_TEMP" nfpm
          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
      # SOURCE_DATE_EPOCH makes the packages reproducible. Alpine is served by install/alpine/APKBUILD instead:
      # nfpm's apk output carries a directory mode apk-tools rejects.
      - name: Build the distribution packages
        run: |
          SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)
          export SOURCE_DATE_EPOCH
          program=build/stage/doona/usr/share/doona
          fonts=build/stage/doona-fonts/usr/share/doona
          precompressed=build/stage/doona-precompressed/usr/share/doona
          mkdir -p "$program" "$fonts" "$precompressed" packages
          tar -xzf "release/doona-${NPM}.tar.gz" -C "$program"
          tar -xzf "release/doona-fonts-${NPM}.tar.gz" -C "$fonts"
          tar -xzf "release/doona-precompressed-${NPM}.tar.gz" -C "$precompressed"
          doc=build/stage/doona/usr/share/doc/doona
          mkdir -p "$doc" build/stage/doona-fonts/usr/share/doc/doona
          mv "$program"/LICENSE "$program"/LICENSES "$program"/NOTICE "$program"/THIRD-PARTY-NOTICES.txt \
            "$program"/README.md "$doc"/
          # The program archive leaves the changelog out; the packages take it from the checkout.
          cp CHANGELOG.md "$doc"/
          # rpm takes the documentation files one by one from doona.yaml; a file it does not list would be missing.
          (cd "$doc" && find . -type f) | sort | while read -r file; do
            grep -qxF "    dst: /usr/share/doc/doona/${file#./}" install/nfpm/doona.yaml ||
              { echo "install/nfpm/doona.yaml does not list ${file#./} for rpm" >&2; exit 1; }
          done
          cp "$fonts"/fonts/OFL.txt build/stage/doona-fonts/usr/share/doc/doona/OFL.txt
          # Debian's archive has an unrelated doona, so only the deb carries the -web suffix (see doona.yaml).
          for packager in deb rpm ipk archlinux; do
            if [ "$packager" = deb ]; then export PACKAGE_SUFFIX=-web; else export PACKAGE_SUFFIX=; fi
            # doona-precompressed depends on exactly this doona version, spelled the way the format spells it.
            if [ "$packager" = archlinux ]; then
              export DOONA_VERSION="${VERSION}${ARCH_PRERELEASE}-${PACKAGE_RELEASE}"
            else
              export DOONA_VERSION="${VERSION}${PRERELEASE:+~$PRERELEASE}-${PACKAGE_RELEASE}"
            fi
            for config in install/nfpm/doona.yaml install/nfpm/doona-fonts.yaml install/nfpm/doona-precompressed.yaml; do
              if [ "$packager" = archlinux ]; then
                # nfpm 2.47 needs an explicit default epoch to retain Arch's prerelease in .PKGINFO.
                arch_config="$RUNNER_TEMP/$(basename "$config")"
                sed "/^version_schema: semver$/a epoch: '0'" "$config" > "$arch_config"
                PRERELEASE="$ARCH_PRERELEASE" nfpm package --config "$arch_config" --packager "$packager" --target packages/
              else
                nfpm package --config "$config" --packager "$packager" --target packages/
              fi
            done
          done
      # Keep upstream SemVer in asset names; package metadata retains each format's own version.
      - name: Name the packages after the upstream version
        run: |
          cd packages
          for name in doona doona-fonts doona-precompressed; do
            deb="doona-web${name#doona}"
            if [ -n "$PRERELEASE" ]; then
              mv "${deb}_${VERSION}~${PRERELEASE}-${PACKAGE_RELEASE}_all.deb" "${deb}_${NPM}-${PACKAGE_RELEASE}_all.deb"
              mv "${name}-${VERSION}~${PRERELEASE}-${PACKAGE_RELEASE}.noarch.rpm" "${name}-${NPM}-${PACKAGE_RELEASE}.noarch.rpm"
              mv "${name}_${VERSION}~${PRERELEASE}-${PACKAGE_RELEASE}_all.ipk" "${name}_${NPM}-${PACKAGE_RELEASE}_all.ipk"
            fi
            ls "${deb}_${NPM}-${PACKAGE_RELEASE}_all.deb" "${name}-${NPM}-${PACKAGE_RELEASE}.noarch.rpm" \
              "${name}_${NPM}-${PACKAGE_RELEASE}_all.ipk" "${name}-${VERSION}${ARCH_PRERELEASE}-${PACKAGE_RELEASE}-any.pkg.tar.zst"
          done
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: nfpm-packages
          path: packages/
          if-no-files-found: error
          retention-days: 1

  alpine:
    needs: [build]
    if: ${{ !cancelled() && needs.build.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      NPM: ${{ needs.build.outputs.NPM }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: archives
          path: release/
      - name: Build the Alpine packages
        run: docker run --rm -v "$PWD:/src" -w /src "$ALPINE_IMAGE" sh tools/package-alpine.sh "$NPM"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: alpine-packages
          path: release/alpine/
          if-no-files-found: error
          retention-days: 1
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: alpine-recipe
          path: release/alpine-recipe/
          if-no-files-found: error

  openwrt-apk:
    needs: [build]
    if: ${{ !cancelled() && needs.build.result == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      NPM: ${{ needs.build.outputs.NPM }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: archives
          path: release/
      # The SDK image builds as its own unprivileged user, which needs to write the output directory.
      - name: Build the OpenWrt apk packages
        run: |
          mkdir -p release/openwrt release/openwrt-recipe
          chmod 777 release/openwrt release/openwrt-recipe
          docker run --rm -v "$PWD:/src" -w /src "$OPENWRT_SDK_IMAGE" sh tools/package-openwrt.sh "$NPM"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: openwrt-packages
          path: release/openwrt/
          if-no-files-found: error
          retention-days: 1
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: openwrt-recipe
          path: release/openwrt-recipe/
          if-no-files-found: error

  # Collects every package next to the archives and sums them, so the release job only uploads.
  sums:
    needs: [build, nfpm, alpine, openwrt-apk]
    if: ${{ !cancelled() && needs.nfpm.result == 'success' && needs.alpine.result == 'success' && needs.openwrt-apk.result == 'success' }}
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: '{archives,*-packages}'
          path: release/
          merge-multiple: true
      - name: Sum every asset
        run: |
          cd release
          sha256sum -- * > "$RUNNER_TEMP/SHA256SUMS"
          mv "$RUNNER_TEMP/SHA256SUMS" SHA256SUMS
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-assets
          path: release/
          if-no-files-found: error

  release:
    needs: [build, nfpm, alpine, openwrt-apk, sums]
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      VERSION: ${{ needs.build.outputs.VERSION }}
      PRERELEASE: ${{ needs.build.outputs.PRERELEASE }}
      ARCH_PRERELEASE: ${{ needs.build.outputs.ARCH_PRERELEASE }}
      NPM: ${{ needs.build.outputs.NPM }}
      PACKAGE_RELEASE: ${{ needs.build.outputs.PACKAGE_RELEASE }}
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-assets
          path: release/
      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          draft: true
          prerelease: ${{ env.PRERELEASE != '' }}
          fail_on_unmatched_files: true
          files: |
            release/*-${{ env.NPM }}.tar.gz
            release/*_${{ env.NPM }}-${{ env.PACKAGE_RELEASE }}_all.deb
            release/*-${{ env.NPM }}-${{ env.PACKAGE_RELEASE }}.noarch.rpm
            release/*_${{ env.NPM }}-${{ env.PACKAGE_RELEASE }}_all.ipk
            release/*-${{ env.VERSION }}${{ env.ARCH_PRERELEASE }}-${{ env.PACKAGE_RELEASE }}-any.pkg.tar.zst
            release/*.apk
            release/doona-alpine.rsa.pub
            release/doona-openwrt.adb
            release/doona-openwrt.pem
            release/SHA256SUMS