release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g., v1.0.0)'
        required: true
        type: string

env:
  GO_VERSION: '1.24.6'
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  release:
    name: Create Release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v5
      with:
        fetch-depth: 0

    - name: Get version
      id: version
      run: |
        if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
          echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
        else
          echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
        fi

    - name: Generate changelog
      id: changelog
      run: |
        # Get commits since last tag
        if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
          LAST_TAG=$(git describe --tags --abbrev=0 HEAD~1 2>/dev/null || echo "")
        else
          LAST_TAG=$(git describe --tags --abbrev=0 HEAD~1 2>/dev/null || echo "")
        fi
        
        if [ -n "$LAST_TAG" ]; then
          CHANGELOG=$(git log --pretty=format:"- %s (%h)" $LAST_TAG..HEAD)
        else
          CHANGELOG=$(git log --pretty=format:"- %s (%h)" --max-count=20)
        fi
        
        echo "changelog<<EOF" >> $GITHUB_OUTPUT
        echo "$CHANGELOG" >> $GITHUB_OUTPUT
        echo "EOF" >> $GITHUB_OUTPUT

    - name: Create Release
      uses: actions/create-release@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        tag_name: ${{ steps.version.outputs.version }}
        release_name: Release ${{ steps.version.outputs.version }}
        body: |
          ## Changes in this Release
          
          ${{ steps.changelog.outputs.changelog }}
          
          ## Docker Images
          
          - `ghcr.io/${{ github.repository }}/worker:${{ steps.version.outputs.version }}`
          - `ghcr.io/${{ github.repository }}/router:${{ steps.version.outputs.version }}`
          - `ghcr.io/${{ github.repository }}/llmrouter:${{ steps.version.outputs.version }}`
        draft: false
        prerelease: false

  build:
    name: Build and Push
    runs-on: ubuntu-latest
    needs: release
    strategy:
      matrix:
        include:
          - component: worker
            dockerfile: Dockerfile.worker
          - component: router
            dockerfile: Dockerfile.router
          - component: llmrouter
            dockerfile: Dockerfile
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v5

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to Container Registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/${{ matrix.component }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=raw,value=latest,enable={{is_default_branch}}

    - name: Build and push Docker image
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ${{ matrix.dockerfile }}
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        platforms: linux/amd64,linux/arm64
        cache-from: type=gha
        cache-to: type=gha,mode=max

  build-binaries:
    name: Build Binaries
    runs-on: ubuntu-latest
    needs: release
    strategy:
      matrix:
        os: [linux, darwin, windows]
        arch: [amd64, arm64]
        exclude:
          - os: windows
            arch: arm64
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v5

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GO_VERSION }}

    - name: Build binaries
      run: |
        mkdir -p dist
        for component in worker router llmrouter kb-indexer; do
          GOOS=${{ matrix.os }} GOARCH=${{ matrix.arch }} go build \
            -ldflags="-s -w -X main.version=${{ needs.release.outputs.version }}" \
            -o dist/${component}-${{ matrix.os }}-${{ matrix.arch }}$(if [ "${{ matrix.os }}" = "windows" ]; then echo .exe; fi) \
            ./cmd/${component}
        done

    - name: Upload binaries
      uses: actions/upload-artifact@v4
      with:
        name: binaries-${{ matrix.os }}-${{ matrix.arch }}
        path: dist/

  publish-release:
    name: Publish Release Assets
    runs-on: ubuntu-latest
    needs: [release, build-binaries]
    
    steps:
    - name: Download all artifacts
      uses: actions/download-artifact@v6

    - name: Create release archive
      run: |
        mkdir -p release
        for os in linux darwin windows; do
          for arch in amd64 arm64; do
            if [ -d "binaries-${os}-${arch}" ]; then
              mkdir -p "release/${os}-${arch}"
              cp binaries-${os}-${arch}/* "release/${os}-${arch}/"
              cd "release/${os}-${arch}"
              tar -czf "../agent-${os}-${arch}.tar.gz" *
              cd ../..
            fi
          done
        done

    - name: Upload release assets
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        upload_url: ${{ needs.release.outputs.upload_url }}
        asset_path: ./release/agent-linux-amd64.tar.gz
        asset_name: agent-linux-amd64.tar.gz
        asset_content_type: application/gzip

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: [build]
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v5

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/worker:${{ needs.release.outputs.version }}
        format: 'sarif'
        output: 'trivy-results.sarif'

    - name: Upload Trivy scan results
      uses: github/codeql-action/upload-sarif@v4
      with:
        sarif_file: 'trivy-results.sarif'