sarin/.github/workflows/release.yaml

name: Build and Release

on:
  release:
    types: [created]
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g., v1.0.0)"
        required: true
      build_binaries:
        description: "Build and upload binaries"
        type: boolean
        default: true
      build_docker:
        description: "Build and push Docker image"
        type: boolean
        default: true

permissions:
  contents: write

jobs:
  nix:
    name: Verify Nix package
    uses: ./.github/workflows/nix.yaml
    permissions:
      contents: read
      pull-requests: write
    with:
      ref: ${{ inputs.tag || github.ref }}

  # nix/package.nix carries its own version string that has to be bumped by
  # hand; catch a forgotten bump before the tag ships.
  version:
    name: Verify package version
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Check nix/package.nix matches the release tag
        env:
          TAG: ${{ inputs.tag || github.ref_name }}
        run: |
          expected="${TAG#v}"
          actual="$(sed -n 's/^[[:space:]]*version = "\([^"]*\)".*/\1/p' nix/package.nix | head -1)"
          if [ -z "$actual" ]; then
            echo "::error file=nix/package.nix::could not read the version string"
            exit 1
          fi
          if [ "$actual" != "$expected" ]; then
            echo "::error file=nix/package.nix::version is '$actual' but the release tag is '$TAG' (expected '$expected')"
            exit 1
          fi
          echo "nix/package.nix version '$actual' matches tag '$TAG'"

  build:
    name: Build binaries
    needs: [nix, version]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Set build metadata
        run: |
          echo "VERSION=$(git describe --tags --always)" >> $GITHUB_ENV
          echo "GIT_COMMIT=$(git rev-parse HEAD)" >> $GITHUB_ENV
          echo "GO_VERSION=1.26.5" >> $GITHUB_ENV

      - name: Set up Go
        if: github.event_name == 'release' || inputs.build_binaries
        uses: actions/setup-go@v7
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Build binaries
        if: github.event_name == 'release' || inputs.build_binaries
        run: |
          LDFLAGS="-X 'go.aykhans.me/sarin/internal/version.Version=${{ env.VERSION }}' \
                   -X 'go.aykhans.me/sarin/internal/version.GitCommit=${{ env.GIT_COMMIT }}' \
                   -X 'go.aykhans.me/sarin/internal/version.BuildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ)' \
                   -X 'go.aykhans.me/sarin/internal/version.GoVersion=$(go version)' \
                   -s -w"

          CGO_ENABLED=0 GOOS=linux   GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-linux-amd64 ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=linux   GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-linux-arm64 ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=freebsd GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-freebsd-amd64 ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=freebsd GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-freebsd-arm64 ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=darwin  GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-darwin-amd64 ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=darwin  GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-darwin-arm64 ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-windows-amd64.exe ./cmd/cli/main.go
          CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-windows-arm64.exe ./cmd/cli/main.go

      - name: Upload Release Assets
        if: github.event_name == 'release' || inputs.build_binaries
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ inputs.tag || github.ref_name }}
          files: ./sarin-*

      - name: Set up QEMU
        if: github.event_name == 'release' || inputs.build_docker
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        if: github.event_name == 'release' || inputs.build_docker
        uses: docker/setup-buildx-action@v4

      - name: Login to Docker Hub
        if: github.event_name == 'release' || inputs.build_docker
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
        if: github.event_name == 'release' || inputs.build_docker
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
            VERSION=${{ env.VERSION }}
            GIT_COMMIT=${{ env.GIT_COMMIT }}
            GO_VERSION=${{ env.GO_VERSION }}
          tags: |
            ${{ secrets.DOCKERHUB_USERNAME }}/sarin:${{ env.VERSION }}
            ${{ secrets.DOCKERHUB_USERNAME }}/sarin:latest