release.yaml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      build-docker:
        description: "Build Docker"
        required: false
        type: boolean
        default: false
      build-binary:
        description: "Build Binary"
        required: false
        type: boolean
        default: true
      draft-release:
        description: "Draft Release"
        required: false
        type: boolean
        default: false

jobs:
  #
  # extract-version extracts the version from the tag or the branch name,
  # for reuse in later jobs
  #
  extract-version:
    name: Extract version
    runs-on: warp-ubuntu-latest-x64-16x
    outputs:
      VERSION: ${{ steps.extract_version.outputs.VERSION }}
    steps:
      - name: Extract version
        id: extract_version
        run: |
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            VERSION="${GITHUB_REF#refs/tags/}"
          else
            SHA_SHORT="$(echo ${GITHUB_SHA} | cut -c1-7)"
            BRANCH_NAME_SAFE="${GITHUB_REF_NAME//\//-}"  # replaces "/" in branch name with "-"
            VERSION="${BRANCH_NAME_SAFE}-${SHA_SHORT}"
          fi
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
          echo "${VERSION}"

          echo "### Version: \`${VERSION}\`" >> $GITHUB_STEP_SUMMARY
          echo "|                     |                        |" >> $GITHUB_STEP_SUMMARY
          echo "| ------------------- | ---------------------- |" >> $GITHUB_STEP_SUMMARY
          echo "| \`GITHUB_REF_TYPE\` | \`${GITHUB_REF_TYPE}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| \`GITHUB_REF_NAME\` | \`${GITHUB_REF_NAME}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| \`GITHUB_REF\`      | \`${GITHUB_REF}\`      |" >> $GITHUB_STEP_SUMMARY
          echo "| \`GITHUB_SHA\`      | \`${GITHUB_SHA}\`      |" >> $GITHUB_STEP_SUMMARY
          echo "| \`VERSION\`         | \`${VERSION}\`         |" >> $GITHUB_STEP_SUMMARY

  #
  # build-binary builds a release binary for a variety of platforms
  #
  build-binary:
    name: Build binary
    needs: extract-version
    if: ${{ github.event.inputs.build-binary == 'true' || github.event_name == 'push'}} # when manually triggered or version tagged
    runs-on: ${{ matrix.configs.runner }}
    env:
      VERSION: ${{ needs.extract-version.outputs.VERSION }}
    permissions:
      contents: write
      packages: write
    strategy:
      matrix:
        configs:
          - target: x86_64-unknown-linux-gnu
            runner: warp-ubuntu-latest-x64-16x
          - target: aarch64-unknown-linux-gnu
            runner: warp-ubuntu-latest-arm64-16x
          - target: aarch64-apple-darwin
            runner: warp-macos-14-arm64-6x
        features:
          - ""
          - "redact_sensitive"

    steps:
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # needed for built.rs to get GIT_HEAD_REF

      # https://github.com/dtolnay/rust-toolchain
      - name: Setup rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          target: ${{ matrix.configs.target }}

      # https://github.com/WarpBuilds/rust-cache
      - name: Run WarpBuilds/rust-cache
        uses: WarpBuilds/rust-cache@v2
        with:
          cache-on-failure: true

      # https://github.com/Mozilla-Actions/sccache-action
      - name: Setup sccache-action
        uses: mozilla-actions/sccache-action@v0.0.5

      - name: Set env vars
        run: |
          echo "SCCACHE_GHA_ENABLED=true" >> $GITHUB_ENV
          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV

      - name: Prepare output filename
        run: |
          if [ -z "${{ matrix.features }}" ]; then
            OUTPUT_FILENAME="rbuilder-${VERSION}-${{ matrix.configs.target }}.tar.gz"
          else
            OUTPUT_FILENAME="rbuilder-${VERSION}-${{ matrix.configs.target }}-${{ matrix.features }}.tar.gz"
          fi
          echo "OUTPUT_FILENAME=$OUTPUT_FILENAME" >> $GITHUB_ENV
          echo "Filename: ${OUTPUT_FILENAME}"

      - name: Build rbuilder binary
        run: cargo build --release --features=${{ matrix.features }}

      - name: Prepare artifacts
        run: |
          mkdir -p artifacts
          tar -czf "artifacts/${OUTPUT_FILENAME}" -C target/release rbuilder

      # https://github.com/actions/upload-artifact
      - name: Upload artifacts
        uses: actions/upload-artifact@v4.3.1
        with:
          name: ${{ env.OUTPUT_FILENAME }}
          path: artifacts/${{ env.OUTPUT_FILENAME }}

  #
  # draft-release runs after building for various targets, collects artifacts and prepares a draft release
  # (only when running against a tag!)
  #
  draft-release:
    name: Draft release
    if: ${{ github.event.inputs.draft-release == 'true' || github.event_name == 'push'}} # when manually triggered or version tagged
    needs: [extract-version, build-binary]
    runs-on: warp-ubuntu-latest-x64-16x
    env:
      VERSION: ${{ needs.extract-version.outputs.VERSION }}
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # https://github.com/actions/download-artifact
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          merge-multiple: true
          path: artifacts

      - name: Record artifacts checksums
        working-directory: artifacts
        run: |
          find ./ || true
          for file in *; do sha256sum "$file" >> sha256sums.txt; done;
          cat sha256sums.txt

      # https://github.com/softprops/action-gh-release
      - name: Create release draft
        uses: softprops/action-gh-release@v2.0.5
        id: create-release-draft
        with:
          draft: true
          files: artifacts/*
          generate_release_notes: true
          name: ${{ env.VERSION }}
          tag_name: ${{ env.VERSION }}

      - name: Write Github Step Summary
        run: |
          echo "---"
          echo "### Release Draft: ${{ env.VERSION }}" >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.create-release-draft.outputs.url }}" >> $GITHUB_STEP_SUMMARY

  #
  # build-docker builds a Docker image and pushes it to the GitHub Container Registry at ghcr.io
  #
  # See also
  # - https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry
  #
  build-docker:
    if: ${{ github.event.inputs.build-docker == 'true' }}
    name: Build and publish Docker image
    needs: extract-version
    runs-on: warp-ubuntu-latest-x64-16x
    env:
      VERSION: ${{ needs.extract-version.outputs.VERSION }}
    permissions:
      contents: read
      packages: write

    steps:
      - name: checkout sources
        uses: actions/checkout@v4

      - name: docker qemu
        uses: docker/setup-qemu-action@v3

      - name: docker buildx
        uses: docker/setup-buildx-action@v3

      # https://github.com/docker/metadata-action
      - name: docker metadata
        uses: docker/metadata-action@v5
        id: meta
        with:
          images: ghcr.io/${{ github.repository }}
          labels: org.opencontainers.image.source=${{ github.repositoryUrl }}
          tags: |
            type=sha
            type=semver,pattern={{version}},value=${{ env.VERSION }}
            type=semver,pattern={{major}}.{{minor}},value=${{ env.VERSION }}
            type=semver,pattern={{major}},value=${{ env.VERSION }}

            # Push latest tag for full version only, not for prerelease versions (i.e. not for v1.2.3-rc1)
            type=raw,value=latest,enable=${{ !contains(env.VERSION, '-') }}

      - name: docker login
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: docker build and push
        uses: docker/build-push-action@v5
        with:
          cache-from: type=gha
          cache-to: type=gha,mode=max
          context: .
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}